CVE-2026-40289: PraisonAI Auth Bypass Vulnerability

CVE-2026-40289 Overview

CVE-2026-40289 is a critical authentication bypass vulnerability in PraisonAI, a multi-agent teams system. The vulnerability exists in the browser bridge component (praisonai browser start) which is susceptible to unauthenticated remote session hijacking due to missing authentication controls and a bypassable origin check on its /ws WebSocket endpoint. The server binds to 0.0.0.0 by default and only validates the Origin header when one is present, allowing any non-browser client that omits the header to connect without restriction.

Critical Impact

An unauthenticated network attacker can connect to the WebSocket endpoint, send a start_session message, and hijack idle browser-extension WebSocket sessions. This enables unauthorized remote control of browser automation sessions, leakage of sensitive page context and automation results, and misuse of model-backed browser actions.

Affected Products

• PraisonAI versions below 4.5.139
• praisonaiagents versions below 1.5.140

Discovery Timeline

• 2026-04-14 - CVE CVE-2026-40289 published to NVD
• 2026-04-14 - Last updated in NVD database

Technical Details for CVE-2026-40289

Vulnerability Analysis

This vulnerability (CWE-306: Missing Authentication for Critical Function) allows attackers to exploit the browser bridge's WebSocket endpoint without any authentication. The core issue stems from two compounding security failures: the service binding to all network interfaces (0.0.0.0) by default, and the conditional Origin header validation that only triggers when the header is present.

When a legitimate browser extension establishes a WebSocket connection to the bridge, it becomes available in a pool of idle sessions. An attacker on the same network can connect to the /ws endpoint, omit the Origin header entirely to bypass the validation check, and send a crafted start_session message. The server then incorrectly routes this request to the first available idle browser-extension WebSocket, effectively granting the attacker control over that session.

The impact is severe: attackers gain unauthorized remote control of connected browser automation sessions, can exfiltrate sensitive page context and automation results being processed, and may abuse model-backed browser actions in any network-accessible deployment.

Root Cause

The root cause is a missing authentication mechanism combined with a flawed Origin header validation implementation. The WebSocket server at the /ws endpoint lacks any form of authentication or authorization checks. Additionally, the Origin header validation is implemented conditionally—it only validates when an Origin header exists in the request, making it trivially bypassable by simply omitting the header in the WebSocket connection request.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker with network access to the browser bridge service can exploit this vulnerability by:

1. Establishing a WebSocket connection to the /ws endpoint without including an Origin header
2. The server accepts the connection due to the conditional origin check bypass
3. Sending a start_session message through the WebSocket
4. The server routes this message to the first idle browser-extension WebSocket in the pool
5. The attacker receives all automation actions and outputs broadcast by the hijacked session

This attack can be executed from any system with network connectivity to the vulnerable bridge service. Since the service binds to 0.0.0.0 by default, any network-reachable deployment is potentially exposed. No special tools or privileges are required beyond the ability to make WebSocket connections.

Detection Methods for CVE-2026-40289

Indicators of Compromise

• Unexpected WebSocket connections to the /ws endpoint from external IP addresses
• WebSocket connection attempts lacking Origin headers in server logs
• Unusual start_session messages from unrecognized client sources
• Browser automation sessions being initiated without corresponding user activity

Detection Strategies

• Monitor WebSocket connection logs for requests missing Origin headers to the browser bridge service
• Implement network-level detection for connections to the default browser bridge port from untrusted networks
• Review server access logs for patterns of connections from non-browser user agents
• Deploy application-layer firewalls to inspect WebSocket traffic for unauthorized session commands

Monitoring Recommendations

• Enable verbose logging on the PraisonAI browser bridge to capture all WebSocket connection details
• Set up alerts for WebSocket connections originating from external network segments
• Monitor for data exfiltration patterns indicating stolen automation results
• Implement anomaly detection for unusual session hijacking behavior patterns

How to Mitigate CVE-2026-40289

Immediate Actions Required

• Upgrade PraisonAI to version 4.5.139 or later immediately
• Upgrade praisonaiagents to version 1.5.140 or later immediately
• Restrict network access to the browser bridge service using firewall rules until patched
• Disable the browser bridge component if not actively required

Patch Information

The vulnerability has been fixed in PraisonAI version 4.5.139 and praisonaiagents version 1.5.140. Organizations should upgrade to these versions or later to remediate the vulnerability. For more details, refer to the GitHub Security Advisory.

Workarounds

• Configure the browser bridge to bind to 127.0.0.1 instead of 0.0.0.0 to restrict access to localhost only
• Implement network segmentation to isolate the browser bridge service from untrusted networks
• Deploy a reverse proxy with authentication in front of the WebSocket endpoint
• Use firewall rules to allowlist only trusted IP addresses that require access to the browser bridge

# Example firewall rule to restrict access to localhost only
# Assuming browser bridge runs on port 8080
iptables -A INPUT -p tcp --dport 8080 -s 127.0.0.1 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP