Executive brief
PraisonAI is an open-source multi-agent AI system that uses JSON Web Tokens (JWTs) to authenticate users and workspace owners. Prior to version 0.1.6, the system defaults to a publicly known hardcoded secret key for signing authentication tokens when configuration is incomplete. An unauthenticated attacker can forge valid authentication tokens to impersonate any user or workspace administrator, potentially gaining full control over the system and accessing sensitive data.
Technical details
The vulnerability is a hardcoded cryptographic key weakness in auth_service.py. When the PLATFORM_JWT_SECRET environment variable is unset and PLATFORM_ENV defaults to 'dev', the service falls back to the publicly known HS256 signing key 'dev-secret-change-me'. An unauthenticated attacker can craft a JWT with an arbitrary 'sub' (subject) claim containing any user or workspace identifier, sign it with this public key, and the AuthService._verify_token() method will accept it as a valid authenticated identity. No authentication guards are enforced because the PLATFORM_ENV setting also defaults to dev mode. The fix in version 0.1.6 removes the default to 'dev' mode and auto-generates a random ephemeral secret when PLATFORM_JWT_SECRET is unset in production.
Affected products
- PraisonAI PraisonAI prior to 0.1.6
Timeline
- 2026-09-15: disclosed
- 2026-06-02: patched: Fix merged in commit e0fb8e7; version 0.1.6 released