CVE-2026-47410: PraisonAI Platform Auth Bypass Flaw

CVE-2026-47410 Overview

CVE-2026-47410 is a critical hardcoded cryptographic key vulnerability [CWE-321] in PraisonAI Platform, the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 ship with a default JWT signing secret set to the literal string "dev-secret-change-me". A safety check exists to reject the default secret, but only activates when PLATFORM_ENV is not equal to "dev". Because PLATFORM_ENV defaults to "dev", the check is silently bypassed in any deployment that does not explicitly opt out. An unauthenticated remote attacker can forge JWT tokens and impersonate any user, including workspace owners and administrators.

Critical Impact
Unauthenticated attackers can mint valid JWTs with arbitrary sub and email claims, achieving full authentication bypass and complete account takeover of any tenant.

Affected Products

PraisonAI Platform versions prior to 0.1.4
Deployments using the default PLATFORM_ENV="dev" configuration
Deployments where PLATFORM_JWT_SECRET is not explicitly set

Discovery Timeline

2026-07-21 - CVE-2026-47410 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-47410

Vulnerability Analysis

The vulnerability resides in the JSON Web Token (JWT) authentication layer of PraisonAI Platform. The application derives its token signing secret from the PLATFORM_JWT_SECRET environment variable. When this variable is unset, the code falls back to the hardcoded string "dev-secret-change-me".

A runtime guard was intended to prevent this default from being used in production. However, the guard only triggers when PLATFORM_ENV is set to a value other than "dev". Because the default value of PLATFORM_ENV is "dev", operators who deploy the platform without customizing both variables silently retain the insecure default. The result is a publicly known signing key protecting all authentication tokens.

Root Cause

The root cause is a hardcoded credential exposed in a public source file, combined with a fail-open safety check. The default value of PLATFORM_ENV inverts the intended protection: instead of failing closed for insecure configurations, the platform silently accepts a well-known secret. This is a classic instance of insecure default configuration compounded by hardcoded cryptographic material.

Attack Vector

An attacker reads the literal "dev-secret-change-me" directly from the public PraisonAI GitHub repository. Using any standard JWT library, the attacker crafts a token signed with HMAC-SHA256 using that key and sets the sub and email claims to match a target user. The forged token is then submitted in the Authorization: Bearer header of an API request. The server validates the signature successfully and treats the request as authenticated. No prior credentials, network position, or user interaction are required.

The patch commit ef79b7a0561796ad9807f0f09538c25cc78d3619 addresses this and related hardening issues in the 0.1.4 release. See the GitHub Security Advisory GHSA-3qg8-5g3r-79v5 for full technical details.

Detection Methods for CVE-2026-47410

Indicators of Compromise

JWT tokens presented to the platform whose signature validates against the literal key dev-secret-change-me
Successful authentication events for privileged accounts without a corresponding login flow or password/MFA challenge
API requests to PraisonAI endpoints from unfamiliar IP addresses using Bearer tokens with anomalous iat or exp claims
Session activity for workspace owners or admins occurring outside their normal access patterns

Detection Strategies

Inspect running instances to confirm whether PLATFORM_JWT_SECRET and PLATFORM_ENV are explicitly set to non-default values.
Attempt to decode recent access tokens with the known default secret. If the signature verifies, the deployment is exposed.
Review authentication and authorization logs for token issuance events that lack a preceding login transaction.
Correlate JWT sub claim values with server-side session records to surface forged identities.

Monitoring Recommendations

Alert on any admin or workspace-owner API action originating from an IP address not previously seen for that account.
Monitor for JWTs signed with a weak or default secret using an offline validator in the SIEM enrichment pipeline.
Track privilege changes, workspace membership additions, and API key generation events for anomaly review.
Retain reverse-proxy access logs including full Authorization header hashes to support forensic token analysis.

How to Mitigate CVE-2026-47410

Immediate Actions Required

Upgrade PraisonAI Platform to version 0.1.4 or later without delay.
Set PLATFORM_JWT_SECRET to a cryptographically random value of at least 32 bytes on every instance.
Set PLATFORM_ENV to a non-dev value such as production or staging for all non-development deployments.
Rotate the JWT signing secret and invalidate all existing tokens after upgrading.
Audit user accounts, workspace membership, and API keys for unauthorized changes since deployment.

Patch Information

PraisonAI Platform version 0.1.4 remediates CVE-2026-47410. The fix is delivered in commit ef79b7a and merged via Pull Request #1685. Refer to the GitHub Security Advisory GHSA-3qg8-5g3r-79v5 for the official vendor notice.

Workarounds

Explicitly set PLATFORM_JWT_SECRET to a strong random value generated with a secure source such as openssl rand -hex 32.
Explicitly set PLATFORM_ENV to a value other than "dev" so the built-in safety check activates.
Restrict network access to the platform to trusted IP ranges using an upstream reverse proxy or WAF while patching.
Force logout of all users and invalidate cached tokens after applying environment changes.

bash

# Configuration example: secure environment variables for PraisonAI Platform
export PLATFORM_JWT_SECRET="$(openssl rand -hex 32)"
export PLATFORM_ENV="production"

# Verify the values are set before starting the service
printenv PLATFORM_JWT_SECRET | wc -c   # expect > 32
printenv PLATFORM_ENV                   # expect: production