EUVD-2026-21162
GHSA-q5r4-47m9-5mc7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessConnect to /media-stream WebSocket endpoint
-
ExploitEstablish unauthenticated session to OpenAI API
-
ExecutionSend unlimited messages without rate limits
-
ImpactExhaust server resources and drain API credits
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Remote unauthenticated attacker can exploit PraisonAI versions prior to 4.5.128 by connecting to the /media-stream WebSocket endpoint without authentication. No victim interaction required. Attacker exhausts OpenAI API credits and server resources through unlimited concurrent connections and messages. |
| Impact | Unauthenticated attackers can exhaust server resources and drain OpenAI API credits via unlimited WebSocket connections to /media-stream. High severity due to network accessibility (AV:N), no authentication required (PR:N), and availability impact (A:H). Organizations running PraisonAI versions before 4.5.128 face immediate credential and financial exposure. |
| Exploit ScenarioDerived | Attacker sends multiple WebSocket connection requests to the /media-stream endpoint without credentials. Each connection opens an authenticated OpenAI Realtime API session using the server's API key, consuming credits until the account is depleted or quota limits trigger denial of service. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 09, 2026
Unauthenticated resource exhaustion in PraisonAI versions prior to 4.5.128 allows remote attackers to drain OpenAI API credits and exhaust server resources. The /media-stream WebSocket endpoint in the call module accepts connections without authentication or Twilio signature validation, enabling unlimited concurrent sessions to OpenAI's Realtime API using the server's credentials. No public exploit identified at time of analysis. Affects PraisonAI deployments exposing the call module's WebSocket interface.
RemediationAI
Vendor-released patch: upgrade to PraisonAI version 4.5.128 or later, which implements authentication and Twilio signature validation on the /media-stream WebSocket endpoint. Until upgrade is feasible, disable or firewall-restrict access to the /media-stream endpoint to trusted IP ranges only. Implement API key rotation and configure OpenAI usage limits to mitigate credit exhaustion risk. Monitor WebSocket connection counts and OpenAI API consumption for anomalies. Official advisory: https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-q5r4-47m9-5mc7
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-770 allocation without limits. The WebSocket endpoint lacks authentication controls and rate limiting, permitting arbitrary clients to spawn authenticated OpenAI Realtime API sessions using server-side credentials. No connection count, message rate, or payload size restrictions enable unbounded resource consumption. Vulnerability resides in call module's media streaming implementation.
Know when Praisonai gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
PraisonAI is a multi-agent teams system. Prior to 4.5.128, the /media-stream WebSocket endpoint in PraisonAI's call module accepts connections from any client without authentication or Twilio signature validation. Each connection opens an authenticated session to OpenAI's Realtime API using the server's API key. There are no limits on concurrent connections, message rate, or message size, allowing an unauthenticated attacker to exhaust server resources and drain the victim's OpenAI API credits. This vulnerability is fixed in 4.5.128.
Executive ViewAI
PraisonAI versions before 4.5.128 contain an unauthenticated resource exhaustion vulnerability in the /media-stream WebSocket endpoint that allows attackers to drain OpenAI API credits and exhaust server resources by initiating unlimited concurrent sessions without validation. Organizations running PraisonAI with the call module exposed face uncontrolled financial and operational impact through stolen API access and infrastructure degradation.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable or restrict network access to /media-stream WebSocket endpoint until upgrade path available; (2) Implement rate limiting and connection limits on WebSocket handlers; (3) Monitor OpenAI API usage for anomalous activity; (4) Segregate PraisonAI call module to isolated network segment with egress controls; (5) Require authentication wrapper at reverse proxy/WAF layer; (6) Rotate OpenAI API keys immediately and monitor billing for unauthorized consumption.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
PraisonAI's TypeScript MCP server (npm package `praisonai`, versions 1.5.0 through 1.7.1) exposes an HTTP JSON-RPC trans
WebSocket origin-validation bypass in PraisonAI's Browser Server (praisonai/browser/server.py) before 4.6.58 lets an att
PraisonAI's `praisonai serve` subsystem (agents and unified modes) accepts an `--api-key` CLI flag that is parsed but ne
Unauthenticated remote agent invocation in PraisonAI versions 4.6.34 through 4.6.57 allows any network-reachable caller
SSRF protection bypass in PraisonAI's praisonaiagents library (all versions before 1.6.58) lets low-privileged users rou
Authentication fail-open in PraisonAI's Recipe HTTP server allows unauthenticated remote attackers to invoke recipe exec
Authentication bypass in PraisonAI's AgentServer component exposes all routes - /publish, /events, /info, /health - to u
Arbitrary Python code execution in PraisonAI's workflow include feature allows an attacker who controls a local recipe d
Server-side request forgery in PraisonAI's web_crawl() function (versions 1.5.128-1.6.57) allows an attacker who can inf
Cross-site request forgery against the PraisonAI MCP HTTP-stream transport allows unauthenticated remote attackers to ex
Remote unauthenticated access to PraisonAI's legacy Flask API server allows attackers to execute configured agent workfl
Path traversal in praisonaiagents prior to 1.6.58 allows a low-privileged caller to write arbitrary JSON files to any pr
Exploit-DB