PT-2026-61802 · Unknown · Praisonai-Platform
CVE-2026-57148
·
Published
2026-06-18
·
Updated
2026-07-23
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
praisonai-platform versions 0.1.4 and earlier
Description
The software uses a hardcoded default JWT signing secret "dev-secret-change-me" when the
PLATFORM JWT SECRET environment variable is not explicitly set. A production guard intended to prevent this is default-open because it only triggers when PLATFORM ENV is not set to "dev", but PLATFORM ENV defaults to "dev". This allows an unauthenticated attacker to forge a JWT with an arbitrary sub (subject) variable and authenticate as any user, including workspace owners. This can lead to complete authentication bypass, workspace takeover, and the ability to delete workspaces or evict members via the DELETE /workspaces/{workspace id} and DELETE /{workspace id}/members/{user id} endpoints. The issue persists in the verify token() function within services/auth service.py and the issue token() function.Recommendations
For versions 0.1.4 and earlier, explicitly export a strong, random value for the
PLATFORM JWT SECRET environment variable.
As a temporary mitigation, restrict access to the issue token() and verify token() functions in services/auth service.py by ensuring the application does not start if the default secret is detected.Fix
Improper Authentication
Using Hardcoded Credentials
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Praisonai-Platform