# CVE-2026-40289: PraisonAI Browser Server session hijacking via unauthenticated WebSocket

Source: https://junglewise.ai/threats/cve-2026-40289-praisonai-browser-server-session-hijacking-via-unauthenticated  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-14. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2026-40289 · Severity: critical · CVSS 9.1 · Published 2026-04-14

PraisonAI is an AI agent framework that includes a browser bridge for automating web tasks. A security flaw in the browser server component allows unauthorized users on the network to take control of active browser automation sessions. An attacker could use this to perform actions in a user's browser or steal sensitive information from open web pages without needing any login credentials.

Technologies: [Praisonai](https://junglewise.ai/threats/technologies/praisonai), [Praisonaiagents](https://junglewise.ai/threats/technologies/praisonaiagents), [praisonai (PyPI)](https://junglewise.ai/threats/technologies/pypi-praisonai), [praisonaiagents (PyPI)](https://junglewise.ai/threats/technologies/pypi-praisonaiagents). Vendors: [Praison](https://junglewise.ai/threats/vendors/praison), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-40289 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40289 being exploited in the wild.

**How severe is CVE-2026-40289?** Critical severity, with a CVSS score of 9.1, published 14 April 2026.

**Which products and versions are affected?** praisonai (PyPI) ECOSYSTEM:introduced=0,fixed=4.5.139; praisonaiagents (PyPI) ECOSYSTEM:introduced=0,fixed=1.5.140.

**Is there a fix for CVE-2026-40289?** Yes. praisonai (PyPI): upgrade to 4.5.139 or later; praisonaiagents (PyPI): upgrade to 1.5.140 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-40289 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-40289?** Check whether you run Praisonai, Praisonaiagents, praisonai (PyPI) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- praisonai (PyPI): upgrade to 4.5.139 or later

  ```sh
  pip install "praisonai>=4.5.139"
  ```

- praisonaiagents (PyPI): upgrade to 1.5.140 or later

  ```sh
  pip install "praisonaiagents>=1.5.140"
  ```


## Technical details

The PraisonAI Browser Server's WebSocket endpoint (/ws) fails to validate the 'Origin' header if it is omitted by the client, allowing non-browser clients to connect without authentication. Additionally, the server binds to 0.0.0.0 by default, exposing the bridge to the network. An attacker can connect as a 'controller', send a 'start_session' message, and the server will automatically route this request to the first available idle browser extension connection. This enables the attacker to execute arbitrary automation commands and receive the resulting data stream (actions and status) from the hijacked session. The vulnerability was patched in PraisonAI version 4.5.139 and praisonaiagents version 1.5.140.

## Affected products

- MervinPraison PraisonAI <= 4.5.138
- MervinPraison praisonaiagents <= 1.5.139

## Identifiers

- CVE-2026-40289
- GHSA-8x8f-54wf-vv92
- PYSEC-2026-467
- PYSEC-2026-485

## Timeline

- 2026-04-10: advisory: GHSA-8x8f-54wf-vv92 published
- 2026-04-10: patched: Fixes released in PraisonAI 4.5.139 and praisonaiagents 1.5.140

## References

- [https://api.github.com/users/R1ZZG0D](https://api.github.com/users/R1ZZG0D)
- [https://github.com/R1ZZG0D](https://github.com/R1ZZG0D)
- [https://api.github.com/users/R1ZZG0D/gists%7B/gist_id%7D](https://api.github.com/users/R1ZZG0D/gists%7B/gist_id%7D)
- [https://api.github.com/users/R1ZZG0D/repos](https://api.github.com/users/R1ZZG0D/repos)
- [https://avatars.githubusercontent.com/u/72493187?v=4](https://avatars.githubusercontent.com/u/72493187?v=4)
- [https://api.github.com/users/R1ZZG0D/events%7B/privacy%7D](https://api.github.com/users/R1ZZG0D/events%7B/privacy%7D)

## Related threats

- [PraisonAI authentication bypass in A2U event streaming](https://junglewise.ai/threats/cve-2026-57146-praisonai-a2u-incomplete-authentication-fix-leaves-current-serve)
- [PraisonAI sandbox escape when Landlock unavailable](https://junglewise.ai/threats/cve-2026-57144-praisonai-sandlocksandbox-falls-back-to-unrestricted-subprocess)
- [PraisonAI recipe policy bypass via YAML-approved tools](https://junglewise.ai/threats/cve-2026-57142-praisonai-recipe-workflow-policy-can-be-bypassed-by-declaring-and)
- [PraisonAI shell command injection in compute-bridged file tools](https://junglewise.ai/threats/cve-2026-57117-praisonai-compute-bridged-file-tools-allow-shell-command)
- [PraisonAI AgentOS authentication bypass in FastAPI deployment](https://junglewise.ai/threats/cve-2026-57116-praisonai-agentos-remains-unauthenticated-after-incomplete-fix)