CVE-2026-57147: PraisonAI JWT Authentication Bypass Vulnerability

CVE-2026-57147 Overview

CVE-2026-57147 is a critical authentication bypass vulnerability in PraisonAI, a multi-agent teams system. Versions prior to 0.1.6 of praisonai-platform assign the public default value dev-secret-change-me to JWT_SECRET when the PLATFORM_JWT_SECRET environment variable is unset. The production guard fails to trigger because PLATFORM_ENV also defaults to dev. A remote unauthenticated attacker can forge HS256 JWT tokens with arbitrary sub and email claims. The platform's AuthService._verify_token() and get_current_user dependency then accept the forged identity across protected API routes. This flaw falls under [CWE-798: Use of Hard-coded Credentials].

Critical Impact
Remote unauthenticated attackers can mint valid JWT tokens for any user, gaining full access to protected API routes without credentials.

Affected Products

PraisonAI praisonai-platform versions prior to 0.1.6
Deployments where PLATFORM_JWT_SECRET is unset
Deployments where PLATFORM_ENV is unset or set to dev

Discovery Timeline

2026-09-15 - CVE-2026-57147 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-57147

Vulnerability Analysis

The vulnerability resides in praisonai_platform/services/auth_service.py. When the environment variable PLATFORM_JWT_SECRET is unset, the service falls back to the hardcoded value dev-secret-change-me. This fallback string is publicly visible in the project's source code.

A secondary production guard exists to prevent this fallback from activating in production deployments. However, that guard depends on PLATFORM_ENV being set to a non-development value. Because PLATFORM_ENV itself defaults to dev when unset, the guard fails silently on any deployment where operators did not explicitly configure both variables.

Any attacker who knows the default secret can craft an HS256-signed JWT with arbitrary sub (subject) and email claims. The AuthService._verify_token() method validates the signature against the hardcoded secret and returns success. The get_current_user FastAPI dependency then trusts the forged identity, granting access to protected endpoints as the impersonated user.

Root Cause

The root cause is a combination of hardcoded credentials [CWE-798] and an insecure default configuration. The safeguard intended to prevent development secrets from being used in production is neutralized because both configuration variables use development-mode defaults, allowing the insecure path to activate silently.

Attack Vector

Exploitation is remote, unauthenticated, and requires no user interaction. An attacker inspects the public PraisonAI repository to obtain the default secret, then uses any standard JWT library to sign a token with attacker-chosen sub and email claims. The token is submitted via the Authorization: Bearer header to any protected API endpoint.

The fix landed in the commit e0fb8e7dd1ee6759c18ed07f436c21dbd9c20747, which hardens JWT secret handling. The same commit replaces unsafe eval() usage in shipped examples with an AST-based safe evaluator.

python

# Excerpt from the security patch replacing eval() in examples/eval/reliability_example.py
def calculate(expression: str) -> str:
    """Calculate a math expression safely."""
    import ast, operator
    _OPS = {ast.Add: operator.add, ast.Sub: operator.sub, ast.Mult: operator.mul,
            ast.Div: operator.truediv, ast.FloorDiv: operator.floordiv,
            ast.Mod: operator.mod, ast.Pow: operator.pow,
            ast.USub: operator.neg, ast.UAdd: operator.pos}
    def _ev(n):
        if isinstance(n, ast.Expression): return _ev(n.body)
        if isinstance(n, ast.Constant) and isinstance(n.value, (int, float)): return n.value
        if isinstance(n, ast.UnaryOp) and type(n.op) in _OPS: return _OPS[type(n.op)](_ev(n.operand))
        if isinstance(n, ast.BinOp) and type(n.op) in _OPS: return _OPS[type(n.op)](_ev(n.left), _ev(n.right))
        raise ValueError(f"Unsupported: {ast.dump(n)}")
    return str(_ev(ast.parse(expression, mode="eval")))

Source: PraisonAI GitHub Commit e0fb8e7

Detection Methods for CVE-2026-57147

Indicators of Compromise

Successful authenticated API calls without a corresponding prior login event in application logs.
JWT tokens signed with the string dev-secret-change-me present in access logs or captured traffic.
Requests to protected /api/ routes originating from unexpected IP addresses using bearer tokens for privileged users.
Access patterns showing a single client accessing multiple distinct user contexts in a short window.

Detection Strategies

Inspect the running configuration for PLATFORM_JWT_SECRET and PLATFORM_ENV; treat any deployment where either is unset as compromised until proven otherwise.
Decode captured JWTs and verify the signing key differs from the known-vulnerable default value.
Correlate API authentication events with identity provider login events; forged tokens will show authenticated access without preceding auth flows.

Monitoring Recommendations

Log every JWT validation result, including the kid or key identifier used, and alert when the default secret is invoked.
Monitor for anomalous sub and email claim combinations that do not match provisioned platform users.
Enable network telemetry on the PraisonAI platform host to detect unexpected outbound activity following API access.

How to Mitigate CVE-2026-57147

Immediate Actions Required

Upgrade praisonai-platform to version 0.1.6 or later immediately.
Rotate the PLATFORM_JWT_SECRET to a cryptographically strong random value of at least 32 bytes on every deployment.
Invalidate all outstanding JWT sessions after rotating the secret to force re-authentication.
Audit API access logs from deployment through patch date for signs of forged-token access.

Patch Information

The vulnerability is fixed in praisonai-platform version 0.1.6. The corrective changes ship in commit e0fb8e7dd1ee6759c18ed07f436c21dbd9c20747 via Pull Request #1793 and are documented in the GHSA-cwj8-7gp2-ggcw Security Advisory. Release notes are available in the PraisonAI v4.6.51 Release.

Workarounds

Explicitly set PLATFORM_JWT_SECRET to a strong random value before starting the service, even on non-production installs.
Explicitly set PLATFORM_ENV=production on production deployments so the existing guard activates.
Restrict network exposure of the PraisonAI platform to trusted networks or place it behind an authenticating reverse proxy until patching is complete.

bash

# Configuration example: set strong JWT secret and production environment before starting the service
export PLATFORM_JWT_SECRET="$(openssl rand -base64 48)"
export PLATFORM_ENV="production"

# Verify variables are set before launching
env | grep -E '^PLATFORM_(JWT_SECRET|ENV)='