Monthly
We need answer in JSON only. Need synthesize. Need be careful with all fields. Need extract data. We have CVE-2026-57148. Description: PraisonAI multi-agent teams system. Prior to 0.1.6, praisonai_platform/services/auth_service.py falls back to public dev-secret-change-me HS256 signing key when PLATFORM_JWT_SECRET unset, while guards disabled because PLATFORM_ENV defaults to dev. Unauthenticated attacker can sign JWT with attacker-chosen sub, AuthService._verify_token accepts, enabling user/workspace-owner impersonation when target identifier known. Fixed in praisonai-platform 0.1.6. CVSS 9.8 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CWE-287. Multi-source: Reported by GitHub_M. CPE cpe:2.3:a:mervinpraison:praisonai:*:*:*:*:*:*:*:*, cpe:2.3:a:mervinpraison:praisonai-platform:*:*:*:*:*:*:*:*. Tags: Authentication Bypass, Praisonai, Praisonai Platform. References GHSA-f38v-77qj-h4jq, PR 1793, commit e0fb8e7..., release v4.6.51. Source code evidence from GHSA advisory: affected <=0.1.4 including 0.1.4 declared patch? main HEAD affected. CWE-1188 + CWE-798 -> CWE-287. Details. Package pip/praisonai-platform vulnerable <=0.1.4 fixed in 0.1.6. PR diff includes examples eval changes irrelevant? Need mention maybe commit/PR contains fix? It seems PR diff includes safe eval changes? But source code evidence says PR diff is maybe unrelated? Need synthesize. We have no EPSS, KEV, POC input. Need use only provided data. KEV not provided -> no KEV; POC? Not explicitly provided, but exploit details? The advisory describes forging token with public key, so maybe exploit technique public but no explicit POC flag. Need say no public exploit identified? But source code evidence includes detailed steps. There is no "POC" field. We can say public exploit code? Careful: "publicly available exploit code exists" if POC=YES but no KEV. Input didn't provide POC. There is no explicit POC. However advisory describes exploitation procedure, but not "POC code". We should use "no public exploi
Let me synthesize. Key facts: - CVE-2026-57134, PraisonAI (npm package "praisonai", TypeScript MCP security helper). - MCPSecurity.evaluatePolicy() only validates credentials for api-key/bearer; basic/oauth accept any non-empty Authorization header, skipping validate() callback, returning authenticated: true. - Affected: npm praisonai >= 1.5.1, <= 1.7.1; fixed in 1.7.2. CPE cpe:2.3:a:mervinpraison:praisonai:*:*:*:*:*:*:*:* - CVSS 8.2 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. But logically, exploitation requires the deployment to use basic or oauth auth policy — that's a configuration prerequisite. Hmm. CVSS PR:N given. My assessed vector: I'd argue PR:N is defensible from the attacker's perspective (attacker sends an arbitrary Authorization header without valid credentials). But the configuration requirement: the target must use basic/oauth policy. AV:N is fine. AC:L? Arguably AC:H because it requires non-default config (basic/oauth policy configured). Let me think: the guidance says choose PR honestly — if exploitation requires control over configuration files, admin access, or authentication, use PR:H or PR:L. Here the attacker doesn't need config access; they need the target to have configured basic or oauth. That's a configuration precondition, not attacker privilege. I'd keep PR:N and use AC:H? Hmm. Many would keep AC:L. Actually the exploit is trivially automatable once the target uses basic/oauth. I'll go AC:L, PR:N, but note the pre-condition. Hmm, but the rubric's example: "Requires write access to the httpd configuration, so PR:H and AC:H". That's different. Here attacker just sends header. I'll use AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N — matching but I should express independent judgment. Maybe I could argue I:L and A:N as given. Let me consider C:H — access to MCP tools and resources protected by policies → confidentiality high, integrity low. That's reasonable. I'll go with AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N — but then it's a copy. The instruction says "NOT
PraisonAI deployments that opt out of authentication by setting PRAISONAI_CALL_AUTH=disabled expose the /api/v1/
Authentication bypass in MISP's optional LdapAuth and LinOTPAuth plugins (versions ≤2.5.45) lets a remote unauthenticated attacker log in as any user whose email they know, without a password. Because LdapAuthenticate and LinOTPAuthenticate reimplement CakePHP's FormAuthenticate but omit its _checkFields() non-empty-string guard, an empty/null password reaches ldap_bind() and - per RFC 4513 §5.1.2 - is treated as an unauthenticated bind that many directories accept as success; impersonation grants the victim's full privileges, potentially administrative. There is no public exploit identified at time of analysis, and SSVC lists exploitation as none, but the technical impact is rated total.
Two-factor authentication bypass in the Really Simple Security WordPress plugin (versions before 9.8.1) allows an attacker who already holds a target account's password to eliminate that account's email 2FA requirement entirely and obtain the resulting session, up to administrator level. The root flaw is an unauthenticated endpoint that resets a completed email 2FA enrollment, collapsing multi-factor authentication to single-factor for the attack window. A publicly available exploit has been published via WPScan, and the vendor has released a fix in version 9.8.1.
MCPHub's embedded OAuth 2.0 authorization server before v1.0.32 allows an attacker who intercepts a victim's authorization code to redeem it for valid access tokens without supplying a client secret or PKCE verifier. The root cause is a logic inversion in client authentication: the pre-fix condition checked `if (clientSecret && client.clientSecret)`, meaning that omitting the secret in a token request caused the entire secret-validation block to be skipped, even for confidential clients with a registered secret. Simultaneously, PKCE enforcement was absent for public clients, leaving no proof-of-possession check between code issuance and token exchange. Vendor-released patch v1.0.32 is available; no public exploit or CISA KEV listing has been identified at time of analysis.
Authentication bypass in the Frontegg SAML SSO WordPress plugin through version 1.0.1 lets unauthenticated remote attackers log in as any user, including administrators, because the plugin establishes a session from a SAML authentication response without verifying its cryptographic signature or issuer. Attackers can also create arbitrary accounts, giving them a persistent foothold. No public exploit identified at time of analysis; EPSS is low (0.19%, 8th percentile) but this reflects lack of observed activity, not difficulty of exploitation.
Full user impersonation in the Laci Synchroni sync server (backend prior to 1.2.3) lets an attacker take over any account by editing the client-side `UID` in their local config.json before login. The server's OAuth2 flow never verified that the authenticated OAuth2 identity actually owned the requested UID, so `AuthorizeOauthAsync` in SecretKeyAuthenticatorService would issue session tokens for an arbitrary target user. Publicly available fix code exists (PR #28, commit 5bc3efd); no known active exploitation and no EPSS/KEV signal was provided.
Cross-origin WebSocket hijacking in Headroom's proxy layer (prior to v0.35.0) allows an unauthenticated attacker-controlled webpage to issue arbitrary LLM requests through the victim's Headroom instance without authentication. Because the WebSocket server forwards requests to the upstream LLM provider without validating the Origin header, any browser with network access to the proxy-standard or headless-can be weaponized as a relay. The primary concrete impact is unauthorized consumption of the stored OpenAI API key and potential exposure of LLM response content; no public exploit code or CISA KEV listing has been identified at time of analysis.
Authentication bypass in the Advanced Customized Prompts WordPress plugin (versions through 1.0.1) lets an unauthenticated attacker obtain a valid authenticated session for any registered account by supplying only an email address, because an unauthenticated action issues the session without ever verifying the password. Attackers can log in as any user - including administrators - or create arbitrary new accounts, yielding full site takeover. Publicly available exploit code exists (reported by WPScan), though there is no public exploit identified as actively exploited in CISA KEV.
We need answer in JSON only. Need synthesize. Need be careful with all fields. Need extract data. We have CVE-2026-57148. Description: PraisonAI multi-agent teams system. Prior to 0.1.6, praisonai_platform/services/auth_service.py falls back to public dev-secret-change-me HS256 signing key when PLATFORM_JWT_SECRET unset, while guards disabled because PLATFORM_ENV defaults to dev. Unauthenticated attacker can sign JWT with attacker-chosen sub, AuthService._verify_token accepts, enabling user/workspace-owner impersonation when target identifier known. Fixed in praisonai-platform 0.1.6. CVSS 9.8 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CWE-287. Multi-source: Reported by GitHub_M. CPE cpe:2.3:a:mervinpraison:praisonai:*:*:*:*:*:*:*:*, cpe:2.3:a:mervinpraison:praisonai-platform:*:*:*:*:*:*:*:*. Tags: Authentication Bypass, Praisonai, Praisonai Platform. References GHSA-f38v-77qj-h4jq, PR 1793, commit e0fb8e7..., release v4.6.51. Source code evidence from GHSA advisory: affected <=0.1.4 including 0.1.4 declared patch? main HEAD affected. CWE-1188 + CWE-798 -> CWE-287. Details. Package pip/praisonai-platform vulnerable <=0.1.4 fixed in 0.1.6. PR diff includes examples eval changes irrelevant? Need mention maybe commit/PR contains fix? It seems PR diff includes safe eval changes? But source code evidence says PR diff is maybe unrelated? Need synthesize. We have no EPSS, KEV, POC input. Need use only provided data. KEV not provided -> no KEV; POC? Not explicitly provided, but exploit details? The advisory describes forging token with public key, so maybe exploit technique public but no explicit POC flag. Need say no public exploit identified? But source code evidence includes detailed steps. There is no "POC" field. We can say public exploit code? Careful: "publicly available exploit code exists" if POC=YES but no KEV. Input didn't provide POC. There is no explicit POC. However advisory describes exploitation procedure, but not "POC code". We should use "no public exploi
Let me synthesize. Key facts: - CVE-2026-57134, PraisonAI (npm package "praisonai", TypeScript MCP security helper). - MCPSecurity.evaluatePolicy() only validates credentials for api-key/bearer; basic/oauth accept any non-empty Authorization header, skipping validate() callback, returning authenticated: true. - Affected: npm praisonai >= 1.5.1, <= 1.7.1; fixed in 1.7.2. CPE cpe:2.3:a:mervinpraison:praisonai:*:*:*:*:*:*:*:* - CVSS 8.2 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. But logically, exploitation requires the deployment to use basic or oauth auth policy — that's a configuration prerequisite. Hmm. CVSS PR:N given. My assessed vector: I'd argue PR:N is defensible from the attacker's perspective (attacker sends an arbitrary Authorization header without valid credentials). But the configuration requirement: the target must use basic/oauth policy. AV:N is fine. AC:L? Arguably AC:H because it requires non-default config (basic/oauth policy configured). Let me think: the guidance says choose PR honestly — if exploitation requires control over configuration files, admin access, or authentication, use PR:H or PR:L. Here the attacker doesn't need config access; they need the target to have configured basic or oauth. That's a configuration precondition, not attacker privilege. I'd keep PR:N and use AC:H? Hmm. Many would keep AC:L. Actually the exploit is trivially automatable once the target uses basic/oauth. I'll go AC:L, PR:N, but note the pre-condition. Hmm, but the rubric's example: "Requires write access to the httpd configuration, so PR:H and AC:H". That's different. Here attacker just sends header. I'll use AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N — matching but I should express independent judgment. Maybe I could argue I:L and A:N as given. Let me consider C:H — access to MCP tools and resources protected by policies → confidentiality high, integrity low. That's reasonable. I'll go with AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N — but then it's a copy. The instruction says "NOT
PraisonAI deployments that opt out of authentication by setting PRAISONAI_CALL_AUTH=disabled expose the /api/v1/
Authentication bypass in MISP's optional LdapAuth and LinOTPAuth plugins (versions ≤2.5.45) lets a remote unauthenticated attacker log in as any user whose email they know, without a password. Because LdapAuthenticate and LinOTPAuthenticate reimplement CakePHP's FormAuthenticate but omit its _checkFields() non-empty-string guard, an empty/null password reaches ldap_bind() and - per RFC 4513 §5.1.2 - is treated as an unauthenticated bind that many directories accept as success; impersonation grants the victim's full privileges, potentially administrative. There is no public exploit identified at time of analysis, and SSVC lists exploitation as none, but the technical impact is rated total.
Two-factor authentication bypass in the Really Simple Security WordPress plugin (versions before 9.8.1) allows an attacker who already holds a target account's password to eliminate that account's email 2FA requirement entirely and obtain the resulting session, up to administrator level. The root flaw is an unauthenticated endpoint that resets a completed email 2FA enrollment, collapsing multi-factor authentication to single-factor for the attack window. A publicly available exploit has been published via WPScan, and the vendor has released a fix in version 9.8.1.
MCPHub's embedded OAuth 2.0 authorization server before v1.0.32 allows an attacker who intercepts a victim's authorization code to redeem it for valid access tokens without supplying a client secret or PKCE verifier. The root cause is a logic inversion in client authentication: the pre-fix condition checked `if (clientSecret && client.clientSecret)`, meaning that omitting the secret in a token request caused the entire secret-validation block to be skipped, even for confidential clients with a registered secret. Simultaneously, PKCE enforcement was absent for public clients, leaving no proof-of-possession check between code issuance and token exchange. Vendor-released patch v1.0.32 is available; no public exploit or CISA KEV listing has been identified at time of analysis.
Authentication bypass in the Frontegg SAML SSO WordPress plugin through version 1.0.1 lets unauthenticated remote attackers log in as any user, including administrators, because the plugin establishes a session from a SAML authentication response without verifying its cryptographic signature or issuer. Attackers can also create arbitrary accounts, giving them a persistent foothold. No public exploit identified at time of analysis; EPSS is low (0.19%, 8th percentile) but this reflects lack of observed activity, not difficulty of exploitation.
Full user impersonation in the Laci Synchroni sync server (backend prior to 1.2.3) lets an attacker take over any account by editing the client-side `UID` in their local config.json before login. The server's OAuth2 flow never verified that the authenticated OAuth2 identity actually owned the requested UID, so `AuthorizeOauthAsync` in SecretKeyAuthenticatorService would issue session tokens for an arbitrary target user. Publicly available fix code exists (PR #28, commit 5bc3efd); no known active exploitation and no EPSS/KEV signal was provided.
Cross-origin WebSocket hijacking in Headroom's proxy layer (prior to v0.35.0) allows an unauthenticated attacker-controlled webpage to issue arbitrary LLM requests through the victim's Headroom instance without authentication. Because the WebSocket server forwards requests to the upstream LLM provider without validating the Origin header, any browser with network access to the proxy-standard or headless-can be weaponized as a relay. The primary concrete impact is unauthorized consumption of the stored OpenAI API key and potential exposure of LLM response content; no public exploit code or CISA KEV listing has been identified at time of analysis.
Authentication bypass in the Advanced Customized Prompts WordPress plugin (versions through 1.0.1) lets an unauthenticated attacker obtain a valid authenticated session for any registered account by supplying only an email address, because an unauthenticated action issues the session without ever verifying the password. Attackers can log in as any user - including administrators - or create arbitrary new accounts, yielding full site takeover. Publicly available exploit code exists (reported by WPScan), though there is no public exploit identified as actively exploited in CISA KEV.