PT-2026-61776 · Praisonai · Praisonai
CVE-2026-57122
·
Published
2026-06-18
·
Updated
2026-07-23
CVSS v3.1
8.6
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L |
Name of the Vulnerable Software and Affected Versions
PraisonAI (affected versions not specified)
Description
The WhatsApp and Linear bot adapters fail to verify inbound webhook HMAC signatures when a secret is not configured, which is the default state for fresh installations and common in development environments. In these cases, the system skips verification entirely and processes the webhook body as a trusted event. A remote, unauthenticated attacker with network access to the bot's webhook endpoint can inject arbitrary platform events.
For WhatsApp, this allows an attacker to spoof senders and message text via the
/webhook endpoint, potentially leading to prompt injection, unauthorized command invocation, or contact impersonation. For Linear, an attacker can forge AgentSession or Comment events to manipulate the agent's actions on issues.The issue resides in the
handle webhook() function, where the signature check is gated by the presence of the WHATSAPP APP SECRET or LINEAR WEBHOOK SECRET variables. If these are unset, the verification logic is bypassed.Recommendations
Configure the
WHATSAPP APP SECRET environment variable to enable signature verification for the WhatsApp adapter.
Configure the LINEAR WEBHOOK SECRET environment variable to enable signature verification for the Linear adapter.
As a temporary mitigation, restrict network access to the /webhook endpoint to trusted sources only.Fix
Insufficient Verification of Data Authenticity
Improper Verification of Cryptographic Signature
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Praisonai