PraisonAI signature verification bypass in WhatsApp and Linear bot webhooks

Executive brief

PraisonAI is an AI agent framework that can integrate with messaging platforms like WhatsApp and Linear. A security flaw in its bot adapters allows attackers to send fake messages or commands to the AI because the system fails to verify the authenticity of incoming data when a security secret is not explicitly set. This could lead to unauthorized actions being performed by the AI agent, such as responding to forged messages or modifying project tasks without permission.

Technical details

The WhatsApp and Linear bot adapters in PraisonAI exhibit a fail-open behavior during webhook processing. In `src/praisonai/praisonai/bots/whatsapp.py` and `linear.py`, the signature verification logic is gated by an `if self._app_secret:` (or `_signing_secret`) check. If the environment variables `WHATSAPP_APP_SECRET` or `LINEAR_WEBHOOK_SECRET` are unset—which is the default state—the code skips HMAC-SHA256 verification entirely and proceeds to parse the request body. A remote, unauthenticated attacker can exploit this by sending crafted JSON payloads to the `/webhook` endpoint to spoof messages or platform events. This can result in prompt injection or unauthorized command execution within the agent session. The issue is addressed in version 4.6.59 by ensuring the system fails closed when secrets are missing.

Affected products

• MervinPraison praisonai <= 4.6.52

Timeline

• 2026-06-17: disclosed: Advisory published by maintainer
• 2026-06-18: advisory: GitHub Advisory published
• 2026-06-18: patched: Fix released in version 4.6.59

References

• https://api.github.com/users/sour-exploit
• https://github.com/sour-exploit
• https://api.github.com/users/sour-exploit/gists%7B/gist_id%7D
• https://api.github.com/users/sour-exploit/repos
• https://avatars.githubusercontent.com/u/288231323?v=4
• https://api.github.com/users/sour-exploit/events%7B/privacy%7D