Affected: MervinPraison PraisonAI, MervinPraison praisonaiagents

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, AgentServer exposes ServerConfig.auth_token but AgentServer._create_app does not check it on any route. A remote caller can subscribe, publish, and perform other actions without a valid bearer token or X-Auth-Token even when authentication is configured. This issue is fixed in version 1.6.58.

Affected: PyPI: praisonaiagents

**Researcher:** Kai Aizen — SnailSploit (@SnailSploit), Adversarial & Offensive Security Research **Target:** https://github.com/MervinPraison/PraisonAI

---

**Package:** `praisonaiagents` on PyPI **Affected version (empirically tested):** 1.6.48 **Component:** `praisonaiagents.server.AgentServer` (the bundled HTTP / SSE server)

---

## TL;DR

`AgentServer.ServerConfig` advertises an `auth_token: Optional[str] = None` field that operators set when they want to lock down the server. The `GET /info` endpoint even displays it back as `"auth_token": "***"` — strongly implying the value is wired into request authentication.

It isn't. `AgentServer._create_app` never reads `auth_token`, never adds an authentication middleware, and never decorates any route with a dependency that checks it. Every route — `/info`, `/publish`, `/events`, `/health` — accepts unauthenticated requests regardless of whether `auth_token` is configured.

The same package contains a *sibling* server, `praisonaiagents.ui.a2a.A2A`, written by the same developer, which implements the bearer-token pattern correctly via FastAPI's `Depends(_verify_auth)`. This rules out the "auth is not yet implemented; operators are expected to add it" reading: the developer knew the pattern but did not apply it to `AgentServer`.

## Root cause

``` Expected behavior when setting ServerConfig(auth_token="…"): "Only requests with a matching Authorization header will be accepted on /publish, /events, /info."

Ac…