Insecure Default Cryptographic Key in PraisonAI Platform Affects Security

CVE-2026-47410

What is CVE-2026-47410?

The PraisonAI Platform contains a significant vulnerability involving an insecure default cryptographic key. In versions prior to 0.1.4, if the PLATFORM_JWT_SECRET is unset, the JWT signing secret defaults to a hardcoded value of 'dev-secret-change-me'. This default value poses a serious risk as it allows attackers to read the literal from the public source file. They can then create a JWT with arbitrary sub and email claims, enabling unauthorized authentication as any existing user, including workspace owners and admins. Although a safety check is implemented, it only activates when PLATFORM_ENV is set to a value other than 'dev', which is the default setting. This flaw highlights a critical oversight in safety mechanisms, requiring immediate attention and upgrade to version 0.1.4 to mitigate the risk.

References