Praisonai Platform
Monthly
We need answer JSON only. Need understand CVE. Need synthesize. Need fill fields. Let's parse data. CVE-2026-57147. PraisonAI multi-agent system. Prior to 0.1.6, praisonai_platform/services/auth_service.py assigns public dev-secret-change-me value to JWT_SECRET when PLATFORM_JWT_SECRET unset, production guard does not run when PLATFORM_ENV unset because defaults dev. Remote unauthenticated attacker can mint HS256 token arbitrary sub/email, AuthService._verify_token() and get_current_user dependency accept forged identity for protected API routes. Fixed in praisonai-platform 0.1.6. CVSS 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. CWE-798. Reported by GitHub_M. CPEs: cpe:2.3:a:mervinpraison:praisonai:*:*:*:*:*:*:*:*, cpe:2.3:a:mervinpraison:praisonai-platform:*:*:*:*:*:*:*:* Tags: Authentication Bypass, Praisonai, Praisonai Platform References: GHSA-cwj8-7gp2-ggcw, PR 1793, commit e0fb..., release tag v4.6.51 (interesting? maybe unrelated release?). Source code evidence: advisory summary. Package praisonai-platform PyPI latest tested 0.1.4, current 2026-06-01. Weakness CWE-798 + CWE-1188. Detail of code. Also fix diff shows examples eval changes, not auth_service? Maybe PR includes unrelated? But description says fixed in 0.1.6. "Package: pip/praisonai-platform — vulnerable: <= 0.1.4 — fixed in: 0.1.6" Hmm maybe <=0.1.5? We say prior to 0.1.6. Need product_name: 1-3 words. likely "PraisonAI Platform" or "praisonai-platform". Use "PraisonAI Platform". Summary not copy description. Need mention specific. Technical context. Risk assessment: CVSS 9.8, EPSS? Not provided. We need say EPSS unknown/not provided. KEV? Input no KEV field. We have no KEV status. POC? Not provided, but exploit technique described publicly in GHSA. Need use only phrases: if neither POC no KEV? But source advisory with detailed exploit maybe no explicit POC. We can say "no public exploit identified at time of analysis" perhaps but technical advisory demonstrates forging token. Need not overstate
We need answer in JSON only. Need synthesize. Need be careful with all fields. Need extract data. We have CVE-2026-57148. Description: PraisonAI multi-agent teams system. Prior to 0.1.6, praisonai_platform/services/auth_service.py falls back to public dev-secret-change-me HS256 signing key when PLATFORM_JWT_SECRET unset, while guards disabled because PLATFORM_ENV defaults to dev. Unauthenticated attacker can sign JWT with attacker-chosen sub, AuthService._verify_token accepts, enabling user/workspace-owner impersonation when target identifier known. Fixed in praisonai-platform 0.1.6. CVSS 9.8 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CWE-287. Multi-source: Reported by GitHub_M. CPE cpe:2.3:a:mervinpraison:praisonai:*:*:*:*:*:*:*:*, cpe:2.3:a:mervinpraison:praisonai-platform:*:*:*:*:*:*:*:*. Tags: Authentication Bypass, Praisonai, Praisonai Platform. References GHSA-f38v-77qj-h4jq, PR 1793, commit e0fb8e7..., release v4.6.51. Source code evidence from GHSA advisory: affected <=0.1.4 including 0.1.4 declared patch? main HEAD affected. CWE-1188 + CWE-798 -> CWE-287. Details. Package pip/praisonai-platform vulnerable <=0.1.4 fixed in 0.1.6. PR diff includes examples eval changes irrelevant? Need mention maybe commit/PR contains fix? It seems PR diff includes safe eval changes? But source code evidence says PR diff is maybe unrelated? Need synthesize. We have no EPSS, KEV, POC input. Need use only provided data. KEV not provided -> no KEV; POC? Not explicitly provided, but exploit details? The advisory describes forging token with public key, so maybe exploit technique public but no explicit POC flag. Need say no public exploit identified? But source code evidence includes detailed steps. There is no "POC" field. We can say public exploit code? Careful: "publicly available exploit code exists" if POC=YES but no KEV. Input didn't provide POC. There is no explicit POC. However advisory describes exploitation procedure, but not "POC code". We should use "no public exploi
We need answer JSON only. Need understand CVE. Need synthesize. Need fill fields. Let's parse data. CVE-2026-57147. PraisonAI multi-agent system. Prior to 0.1.6, praisonai_platform/services/auth_service.py assigns public dev-secret-change-me value to JWT_SECRET when PLATFORM_JWT_SECRET unset, production guard does not run when PLATFORM_ENV unset because defaults dev. Remote unauthenticated attacker can mint HS256 token arbitrary sub/email, AuthService._verify_token() and get_current_user dependency accept forged identity for protected API routes. Fixed in praisonai-platform 0.1.6. CVSS 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. CWE-798. Reported by GitHub_M. CPEs: cpe:2.3:a:mervinpraison:praisonai:*:*:*:*:*:*:*:*, cpe:2.3:a:mervinpraison:praisonai-platform:*:*:*:*:*:*:*:* Tags: Authentication Bypass, Praisonai, Praisonai Platform References: GHSA-cwj8-7gp2-ggcw, PR 1793, commit e0fb..., release tag v4.6.51 (interesting? maybe unrelated release?). Source code evidence: advisory summary. Package praisonai-platform PyPI latest tested 0.1.4, current 2026-06-01. Weakness CWE-798 + CWE-1188. Detail of code. Also fix diff shows examples eval changes, not auth_service? Maybe PR includes unrelated? But description says fixed in 0.1.6. "Package: pip/praisonai-platform — vulnerable: <= 0.1.4 — fixed in: 0.1.6" Hmm maybe <=0.1.5? We say prior to 0.1.6. Need product_name: 1-3 words. likely "PraisonAI Platform" or "praisonai-platform". Use "PraisonAI Platform". Summary not copy description. Need mention specific. Technical context. Risk assessment: CVSS 9.8, EPSS? Not provided. We need say EPSS unknown/not provided. KEV? Input no KEV field. We have no KEV status. POC? Not provided, but exploit technique described publicly in GHSA. Need use only phrases: if neither POC no KEV? But source advisory with detailed exploit maybe no explicit POC. We can say "no public exploit identified at time of analysis" perhaps but technical advisory demonstrates forging token. Need not overstate
We need answer in JSON only. Need synthesize. Need be careful with all fields. Need extract data. We have CVE-2026-57148. Description: PraisonAI multi-agent teams system. Prior to 0.1.6, praisonai_platform/services/auth_service.py falls back to public dev-secret-change-me HS256 signing key when PLATFORM_JWT_SECRET unset, while guards disabled because PLATFORM_ENV defaults to dev. Unauthenticated attacker can sign JWT with attacker-chosen sub, AuthService._verify_token accepts, enabling user/workspace-owner impersonation when target identifier known. Fixed in praisonai-platform 0.1.6. CVSS 9.8 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CWE-287. Multi-source: Reported by GitHub_M. CPE cpe:2.3:a:mervinpraison:praisonai:*:*:*:*:*:*:*:*, cpe:2.3:a:mervinpraison:praisonai-platform:*:*:*:*:*:*:*:*. Tags: Authentication Bypass, Praisonai, Praisonai Platform. References GHSA-f38v-77qj-h4jq, PR 1793, commit e0fb8e7..., release v4.6.51. Source code evidence from GHSA advisory: affected <=0.1.4 including 0.1.4 declared patch? main HEAD affected. CWE-1188 + CWE-798 -> CWE-287. Details. Package pip/praisonai-platform vulnerable <=0.1.4 fixed in 0.1.6. PR diff includes examples eval changes irrelevant? Need mention maybe commit/PR contains fix? It seems PR diff includes safe eval changes? But source code evidence says PR diff is maybe unrelated? Need synthesize. We have no EPSS, KEV, POC input. Need use only provided data. KEV not provided -> no KEV; POC? Not explicitly provided, but exploit details? The advisory describes forging token with public key, so maybe exploit technique public but no explicit POC flag. Need say no public exploit identified? But source code evidence includes detailed steps. There is no "POC" field. We can say public exploit code? Careful: "publicly available exploit code exists" if POC=YES but no KEV. Input didn't provide POC. There is no explicit POC. However advisory describes exploitation procedure, but not "POC code". We should use "no public exploi