CVE-2026-40289: PraisonAI Auth Bypass Vulnerability

CVE-2026-40289 Overview

CVE-2026-40289 is a critical authentication bypass vulnerability in PraisonAI, a multi-agent teams system. The vulnerability exists in the browser bridge component (praisonai browser start) which is susceptible to unauthenticated remote session hijacking due to missing authentication controls and a bypassable origin check on its /ws WebSocket endpoint. The server binds to 0.0.0.0 by default and only validates the Origin header when one is present, allowing any non-browser client that omits the header to connect without restriction.

Critical Impact
An unauthenticated network attacker can connect to the WebSocket endpoint, send a start_session message, and hijack idle browser-extension WebSocket sessions. This enables unauthorized remote control of browser automation sessions, leakage of sensitive page context and automation results, and misuse of model-backed browser actions.

Affected Products

PraisonAI versions below 4.5.139
praisonaiagents versions below 1.5.140

Discovery Timeline

2026-04-14 - CVE CVE-2026-40289 published to NVD
2026-04-14 - Last updated in NVD database

Technical Details for CVE-2026-40289

Vulnerability Analysis

This vulnerability (CWE-306: Missing Authentication for Critical Function) allows attackers to exploit the browser bridge's WebSocket endpoint without any authentication. The core issue stems from two compounding security failures: the service binding to all network interfaces (0.0.0.0) by default, and the conditional Origin header validation that only triggers when the header is present.

When a legitimate browser extension establishes a WebSocket connection to the bridge, it becomes available in a pool of idle sessions. An attacker on the same network can connect to the /ws endpoint, omit the Origin header entirely to bypass the validation check, and send a crafted start_session message. The server then incorrectly routes this request to the first available idle browser-extension WebSocket, effectively granting the attacker control over that session.

The impact is severe: attackers gain unauthorized remote control of connected browser automation sessions, can exfiltrate sensitive page context and automation results being processed, and may abuse model-backed browser actions in any network-accessible deployment.

Root Cause

The root cause is a missing authentication mechanism combined with a flawed Origin header validation implementation. The WebSocket server at the /ws endpoint lacks any form of authentication or authorization checks. Additionally, the Origin header validation is implemented conditionally—it only validates when an Origin header exists in the request, making it trivially bypassable by simply omitting the header in the WebSocket connection request.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker with network access to the browser bridge service can exploit this vulnerability by:

Establishing a WebSocket connection to the /ws endpoint without including an Origin header
The server accepts the connection due to the conditional origin check bypass
Sending a start_session message through the WebSocket
The server routes this message to the first idle browser-extension WebSocket in the pool
The attacker receives all automation actions and outputs broadcast by the hijacked session

This attack can be executed from any system with network connectivity to the vulnerable bridge service. Since the service binds to 0.0.0.0 by default, any network-reachable deployment is potentially exposed. No special tools or privileges are required beyond the ability to make WebSocket connections.

Detection Methods for CVE-2026-40289

Indicators of Compromise

Unexpected WebSocket connections to the /ws endpoint from external IP addresses
WebSocket connection attempts lacking Origin headers in server logs
Unusual start_session messages from unrecognized client sources
Browser automation sessions being initiated without corresponding user activity

Detection Strategies

Monitor WebSocket connection logs for requests missing Origin headers to the browser bridge service
Implement network-level detection for connections to the default browser bridge port from untrusted networks
Review server access logs for patterns of connections from non-browser user agents
Deploy application-layer firewalls to inspect WebSocket traffic for unauthorized session commands

Monitoring Recommendations

Enable verbose logging on the PraisonAI browser bridge to capture all WebSocket connection details
Set up alerts for WebSocket connections originating from external network segments
Monitor for data exfiltration patterns indicating stolen automation results
Implement anomaly detection for unusual session hijacking behavior patterns

How to Mitigate CVE-2026-40289

Immediate Actions Required

Upgrade PraisonAI to version 4.5.139 or later immediately
Upgrade praisonaiagents to version 1.5.140 or later immediately
Restrict network access to the browser bridge service using firewall rules until patched
Disable the browser bridge component if not actively required

Patch Information

The vulnerability has been fixed in PraisonAI version 4.5.139 and praisonaiagents version 1.5.140. Organizations should upgrade to these versions or later to remediate the vulnerability. For more details, refer to the GitHub Security Advisory.

Workarounds

Configure the browser bridge to bind to 127.0.0.1 instead of 0.0.0.0 to restrict access to localhost only
Implement network segmentation to isolate the browser bridge service from untrusted networks
Deploy a reverse proxy with authentication in front of the WebSocket endpoint
Use firewall rules to allowlist only trusted IP addresses that require access to the browser bridge

bash

# Example firewall rule to restrict access to localhost only
# Assuming browser bridge runs on port 8080
iptables -A INPUT -p tcp --dport 8080 -s 127.0.0.1 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP