CVE-2026-34953: Praison Praisonai Auth Bypass Vulnerability

CVE-2026-34953 Overview

CVE-2026-34953 is a critical authentication bypass vulnerability in PraisonAI, a multi-agent teams system. Prior to version 4.5.97, the OAuthManager.validate_token() function incorrectly returns True for any token not found in its internal store, which is empty by default. This flawed logic allows any HTTP request to the MCP server with an arbitrary Bearer token to be treated as authenticated, granting full access to all registered tools and agent capabilities.

Critical Impact

Unauthenticated remote attackers can gain full access to all registered tools and agent capabilities in PraisonAI deployments by providing any arbitrary Bearer token.

Affected Products

• PraisonAI versions prior to 4.5.97
• praison praisonai

Discovery Timeline

• 2026-04-03 - CVE-2026-34953 published to NVD
• 2026-04-09 - Last updated in NVD database

Technical Details for CVE-2026-34953

Vulnerability Analysis

This vulnerability represents a severe Broken Access Control flaw (CWE-863: Incorrect Authorization) in the PraisonAI authentication mechanism. The core issue lies in the OAuthManager.validate_token() method's flawed validation logic. When a token is checked against the internal token store, the function incorrectly returns True if the token is not found, rather than returning False to deny access.

Since the internal token store is empty by default upon deployment, every token validation check will result in a positive authentication response. This means that any attacker who can reach the MCP server endpoint can simply craft an HTTP request with any arbitrary Bearer token value in the Authorization header, and the system will treat this request as fully authenticated.

The vulnerability is network-exploitable without requiring any prior authentication or user interaction, allowing attackers to bypass all authentication controls and gain unauthorized access to the entire agent ecosystem.

Root Cause

The root cause is an inverted logic error in the OAuthManager.validate_token() function. The method returns True (authenticated) for tokens that are NOT found in the token store, instead of returning False (unauthenticated). Combined with the fact that the token store is empty by default, this creates a situation where all authentication attempts succeed regardless of the token value provided.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Identifying a PraisonAI MCP server endpoint accessible over the network
2. Sending an HTTP request with an Authorization header containing any arbitrary Bearer token value
3. The OAuthManager.validate_token() function checks if the token exists in the empty internal store
4. Since the token is not found (because no tokens exist), the function incorrectly returns True
5. The attacker is granted full authenticated access to all registered tools and agent capabilities

The vulnerability can be exploited through simple HTTP requests to the MCP server. No special tools or complex exploitation techniques are required. See the GitHub Security Advisory for technical details on the vulnerable code path.

Detection Methods for CVE-2026-34953

Indicators of Compromise

• Unexpected or unauthorized API requests to the MCP server from unknown IP addresses
• Bearer tokens in authentication logs that do not match any legitimately issued tokens
• Unusual agent activity or tool executions not initiated by authorized users
• Access logs showing successful authentication from multiple distinct Bearer token values

Detection Strategies

• Monitor authentication logs for requests using unrecognized Bearer tokens
• Implement rate limiting and alerting on authentication attempts to the MCP server
• Deploy network intrusion detection rules to identify suspicious traffic patterns to PraisonAI endpoints
• Audit agent and tool execution logs for unauthorized or anomalous activity

Monitoring Recommendations

• Enable verbose logging on the MCP server to capture all authentication attempts and token values
• Set up alerts for successful authentication events that do not correlate with legitimate user sessions
• Monitor for bulk or automated requests to agent endpoints that could indicate exploitation
• Review access patterns regularly to identify potential unauthorized access

How to Mitigate CVE-2026-34953

Immediate Actions Required

• Upgrade PraisonAI to version 4.5.97 or later immediately
• If immediate upgrade is not possible, restrict network access to the MCP server to trusted IP addresses only
• Audit logs for any signs of unauthorized access or exploitation
• Review and revoke any suspicious agent activities or tool executions

Patch Information

Praison has released version 4.5.97 of PraisonAI which corrects the authentication bypass vulnerability in OAuthManager.validate_token(). Organizations running affected versions should upgrade immediately. For detailed patch information, refer to the GitHub Security Advisory.

Workarounds

• Restrict network access to the MCP server using firewall rules to allow only trusted IP addresses
• Deploy a reverse proxy with proper authentication in front of the PraisonAI MCP server
• Disable external network access to the MCP server until the patch can be applied
• Implement network segmentation to isolate PraisonAI deployments from untrusted networks

# Example: Restrict MCP server access using iptables
# Allow only trusted IP ranges to access the MCP server port (adjust port as needed)
iptables -A INPUT -p tcp --dport 8080 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP