CVE-2026-57148
Received Received - Intake

JWT Signing Key Bypass in PraisonAI Platform

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
PraisonAI is a multi-agent teams system. Prior to 0.1.6, praisonai_platform/services/auth_service.py falls back to the public dev-secret-change-me HS256 signing key when PLATFORM_JWT_SECRET is unset, while the startup and token-issuance guards are disabled because PLATFORM_ENV also defaults to dev. An unauthenticated attacker can sign a JWT containing an attacker-chosen sub value, and AuthService._verify_token() accepts it as an authenticated identity, enabling user or workspace-owner impersonation when a target identifier is known. This vulnerability is fixed in praisonai-platform 0.1.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-57148
EUVD
EUVD-2026-78396

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
praisonai praisonai_platform 0.1.6

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-798 The product contains hard-coded credentials, such as a password or cryptographic key.
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-1188 The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-57148 is an authentication bypass vulnerability in PraisonAI versions 0.1.4 and earlier. It occurs because the system uses a hardcoded default JWT signing key 'dev-secret-change-me' when the PLATFORM_JWT_SECRET environment variable is not set. The PLATFORM_ENV variable also defaults to 'dev' when unset, disabling security guards. This allows attackers to forge JWT tokens with arbitrary user IDs, gaining full authentication as those users.

Detection Guidance

Check if your PraisonAI deployment uses the default JWT secret 'dev-secret-change-me' by inspecting environment variables. Verify if PLATFORM_ENV is set to 'dev' and if PLATFORM_JWT_SECRET is unset. Look for JWT tokens signed with the default secret in logs or network traffic.

Impact Analysis

An attacker can impersonate any user or workspace owner by forging JWT tokens. This enables unauthorized access to sensitive data, modification of user accounts, deletion of resources, and complete control over affected systems. The impact includes data breaches, service disruption, and potential compliance violations.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA requirements for access controls and data protection. It enables unauthorized access to personal data, which could result in data breaches. Organizations using affected versions may face regulatory fines, legal liabilities, and reputational damage due to non-compliance with security and privacy standards.

Mitigation Strategies

Upgrade to praisonai-platform 0.1.6 or later. Ensure PLATFORM_JWT_SECRET is set to a strong, unique value and PLATFORM_ENV is explicitly configured. Remove any default secret fallback and regenerate all JWT secrets.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-57148. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart