PT-2026-53154 · Pypi · Praisonai
Published
2026-06-18
·
Updated
2026-06-18
CVSS v3.1
8.6
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L |
The WhatsApp and Linear bot adapters verify the inbound webhook HMAC signature only
when a secret is configured. When the secret environment variable is unset — the
default on a fresh install and common in development — verification is skipped entirely
and the webhook body is parsed and dispatched as a genuine, trusted event. A remote,
unauthenticated attacker who can reach the bot's webhook endpoint can inject arbitrary
platform events.
Affected code:
WhatsApp - src/praisonai/praisonai/bots/whatsapp.py
- init (line 108): self. app secret = app secret or os.environ.get("WHATSAPP APP SECRET", "") -> defaults to ""
- route (line 246): app.router.add post(self. webhook path, self. handle webhook) -> default path "/webhook"
- handle webhook (lines 585-595):
if self. app secret:gates the ENTIRE check; when falsy the body is json.loads()'d and dispatched to process webhook data() with no verification.
Linear - src/praisonai/praisonai/bots/linear.py
- init (line 86): self. signing secret = signing secret or os.environ.get("LINEAR WEBHOOK SECRET", "") -> ""
- handle webhook (lines 244-248): same
if self. signing secret:fail-open guard. - start() (lines 169-170): only logs a warning; does not fail closed.
The verify signature implementations themselves are correct (constant-time HMAC-SHA256);
the defect is that verification is bypassed when the secret is absent.
Impact:
- WhatsApp: attacker POSTs a crafted Meta Cloud API payload spoofing any sender and message text; injected into agent sessions and processed as a real user message (prompt injection, unauthorized agent/command invocation, contact impersonation).
- Linear: attacker POSTs forged AgentSession / Comment events, causing the agent to act on and comment on issues no legitimate event referenced. The webhook routes require no other authentication, so exploitation needs only network reachability.
Proof of concept (bot started without the secret - the default):
curl -X POST http://VICTIM:PORT/webhook
-H 'Content-Type: application/json'
-d '{"object":"whatsapp business account","entry":[{"changes":[{"value":
{"messages":[{"from":"15551234567","id":"wamid.x","type":"text",
"text":{"body":"attacker-injected message"}}]}}]}]}'
No X-Hub-Signature-256 header; bot returns 200 and processes the message.
Linear: omit LINEAR WEBHOOK SECRET and POST without a Linear-Signature header.
A self-contained PoC that executes the real handle webhook / verify signature source
extracted from the repo confirms: secret unset -> status 200, payload dispatched (VULNERABLE);
secret set + no signature -> status 403, nothing dispatched (control).
Remediation:
Fail closed. When no secret is configured, reject all webhooks (HTTP 403) and refuse to start
the adapter unless a secret is set (or an explicit, clearly-named insecure-dev override is given):
if not self. app secret:
return web.Response(status=403, text="Webhook secret not configured")
signature = request.headers.get("X-Hub-Signature-256", "")
if not self. verify signature(body, signature):
return web.Response(status=403, text="Invalid signature")
Distinct from prior advisories:
The accepted default-insecure advisories cover a different surface/mechanism — CALL SERVER TOKEN
unset (GHSA-86qc-r5v2-v6x6) and the JWT key default "dev-secret-change-me" (GHSA-3qg8-5g3r-79v5).
This is in the bot webhook adapters and the mechanism is skipping signature verification entirely
when the secret is absent, not a weak default key.
Fix
Improper Verification of Cryptographic Signature
Insufficient Verification of Data Authenticity
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Praisonai