Executive brief
PraisonAI, a platform for managing teams of AI agents, contains a critical security flaw in its authentication system. Due to a coding error, the system incorrectly validates security tokens, allowing anyone to bypass login requirements by providing any random text as a password. An attacker could use this to gain full control over the AI agents, including the ability to read or write files and execute arbitrary workflows, potentially leading to data theft or unauthorized system access.
Technical details
An authentication bypass exists in PraisonAI's `OAuthManager.validate_token()` function. The vulnerability is caused by a logic error where the function iterates through an internal token store (which is empty by default) and, if no match is found, returns `True` instead of `False`. This 'fail-open' behavior allows any HTTP request to the Model Context Protocol (MCP) server with an arbitrary Bearer token to be treated as fully authenticated. An attacker can exploit this over the network to access all registered tools, including `agent.run`, `workflow.run`, and `containers.file_write`. The issue is fixed in version 4.5.97 by ensuring unknown tokens are rejected.
Affected products
- MervinPraison PraisonAI < 4.5.97
Timeline
- 2026-03-31: advisory: Vendor advisory published on GitHub
- 2026-04-03: disclosed: CVE published to NVD