Executive brief
PraisonAI's MCPSecurity library is used to protect MCP (Model Context Protocol) servers by enforcing authentication policies. The library advertises support for Basic and OAuth authentication methods but fails to validate credentials for these methods, accepting any non-empty Authorization header as valid. This allows attackers to bypass authentication protections and access protected MCP tools, resources, and trigger agent actions without valid credentials.
Technical details
The vulnerability is an authentication bypass in the evaluatePolicy() function of MCPSecurity's authentication evaluator. The vulnerability class is CWE-287 (Improper Authentication) / CWE-288 (Authentication Bypass Using an Alternate Path). The library's evaluatePolicy() method only calls the configured validate() callback for 'api-key' and 'bearer' authentication methods. For 'basic' and 'oauth' methods, after extracting a non-empty token from the Authorization header, the code falls through to a success return without invoking the validator, accepting any request with a non-empty Authorization header as authenticated. The attack vector is network-based with no authentication or user interaction required. An attacker can send an HTTP request with any non-empty Basic or OAuth Authorization header to bypass authentication and access protected MCP resources, call protected tools, or trigger agent workflows. Patch: Fixed in npm praisonai version 1.7.2 and later.
Affected products
- npm praisonai >=1.5.1, <=1.7.1
Timeline
- 2026-06-18: disclosed: Advisory GHSA-4qq2-2j2x-x62c published on GitHub
- 2026-06-18: patched: Fixed in npm praisonai version 1.7.2