PT-2026-61801 · Unknown · Praisonai-Platform
CVE-2026-57147
·
Published
2026-06-18
·
Updated
2026-07-23
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
praisonai-platform version 0.1.4
Description
The software uses a hardcoded default secret
dev-secret-change-me for signing JSON Web Tokens (JWT). A security guard intended to prevent the application from starting in production with this default secret is incorrectly implemented. The guard only triggers if the PLATFORM JWT SECRET is the default value AND the PLATFORM ENV variable is explicitly set to something other than dev. If both environment variables are left unset, the system defaults to dev mode and starts normally using the public secret.An unauthenticated attacker can use this public secret to forge JWTs with arbitrary user identities, including administrative accounts. This allows the attacker to bypass authentication for all protected routes in the application, such as those managing workspaces, projects, agents, and user activity. The vulnerability is further exacerbated by the use of the
HS256 algorithm with a key that is shorter than the recommended 32 bytes.Technical details include:
- Vulnerable Parameters:
PLATFORM JWT SECRETandPLATFORM ENVenvironment variables. - Function Names:
issue token()andverify token()inauth service.py.
Recommendations
For version 0.1.4, set the
PLATFORM JWT SECRET environment variable to a strong, random value of at least 32 characters.
As a temporary mitigation, ensure that the PLATFORM ENV variable is explicitly set to a value other than dev to trigger the startup guard, although the primary fix is to provide a secure secret.Fix
Using Hardcoded Credentials
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Praisonai-Platform