Executive brief
PraisonAI is an AI framework that includes a module for handling voice calls. A security flaw in its call handling component allows anyone on the internet to connect to the server without a password. An attacker can use this to make the server perform expensive AI tasks billed to the owner's OpenAI account, potentially leading to significant financial costs and causing the service to crash or become unavailable for legitimate users.
Technical details
The vulnerability exists in the `/media-stream` WebSocket endpoint within `src/praisonai/praisonai/api/call.py`. The endpoint fails to implement authentication middleware, Twilio request signature validation (X-Twilio-Signature), or connection/rate limits. Upon connection, the server automatically establishes an authenticated session with OpenAI's Realtime API using the host's `OPENAI_API_KEY`. An unauthenticated remote attacker can exploit this to forward arbitrary audio data to OpenAI, draining the victim's API credits. Furthermore, the lack of `ws_max_size` constraints and connection limits allows for memory exhaustion and Denial of Service (DoS). The issue is fixed in version 4.5.128.
Affected products
- MervinPraison PraisonAI < 4.5.128
Timeline
- 2026-04-09: patched: Fixed in version 4.5.128
- 2026-04-10: advisory