EUVD-2026-21162
GHSA-q5r4-47m9-5mc7
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
5DescriptionGitHub Advisory
PraisonAI is a multi-agent teams system. Prior to 4.5.128, the /media-stream WebSocket endpoint in PraisonAI's call module accepts connections from any client without authentication or Twilio signature validation. Each connection opens an authenticated session to OpenAI's Realtime API using the server's API key. There are no limits on concurrent connections, message rate, or message size, allowing an unauthenticated attacker to exhaust server resources and drain the victim's OpenAI API credits. This vulnerability is fixed in 4.5.128.
AnalysisAI
Unauthenticated resource exhaustion in PraisonAI versions prior to 4.5.128 allows remote attackers to drain OpenAI API credits and exhaust server resources. The /media-stream WebSocket endpoint in the call module accepts connections without authentication or Twilio signature validation, enabling unlimited concurrent sessions to OpenAI's Realtime API using the server's credentials. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Remote unauthenticated attacker can exploit PraisonAI versions prior to 4.5.128 by connecting to the /media-stream WebSocket endpoint without authentication. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Unauthenticated attackers can exhaust server resources and drain OpenAI API credits via unlimited WebSocket connections to /media-stream. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Attacker sends multiple WebSocket connection requests to the /media-stream endpoint without credentials. Each connection opens an authenticated OpenAI Realtime API session using the server's API key, consuming credits until the account is depleted or quota limits trigger denial of service. |
| Remediation | Vendor-released patch: upgrade to PraisonAI version 4.5.128 or later, which implements authentication and Twilio signature validation on the /media-stream WebSocket endpoint. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all PraisonAI deployments with call module enabled and inventory current version numbers; immediately restrict network access to /media-stream WebSocket endpoint via firewall or WAF rules to trusted sources only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today