PT-2026-45064 · Unknown · Praisonai-Platform
CVE-2026-47410
·
Published
2026-05-29
·
Updated
2026-07-21
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
praisonai-platform (affected versions not specified)
Description
The software uses an insecure default cryptographic key for signing JSON Web Tokens (JWT). When the
PLATFORM JWT SECRET environment variable is unset, the system defaults to a hardcoded literal string. A safety check intended to prevent this in production is bypassed because it only triggers when PLATFORM ENV is set to a value other than dev, while the default value of PLATFORM ENV is dev. An attacker can use this publicly known secret to forge JWTs with arbitrary sub and email claims, allowing them to authenticate as any user, including administrators and workspace owners, across all authenticated routes. This leads to full account takeover without requiring prior authentication or user interaction. The issue is present in the verify token() function within the src/praisonai-platform/praisonai platform/services/auth service.py file, which trusts the token claims once the signature is validated against the default secret. The vulnerability can be exploited via the /auth/me endpoint.Recommendations
Set the
PLATFORM JWT SECRET environment variable to a strong, random value of at least 32 bytes.
Ensure the PLATFORM ENV variable is set to a non-dev value in production environments to enable safety checks.
As a temporary mitigation, restrict network access to the API to trusted sources only.Exploit
Fix
Using Hardcoded Credentials
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Praisonai-Platform