Authorization Vulnerability in PraisonAI Multi-Agent Teams System

CVE-2026-57148

What is CVE-2026-57148?

The PraisonAI multi-agent teams system contains a significant security flaw in its authentication mechanism. Versions prior to 0.1.6 inadequately handle the JWT signing key, defaulting to a public development secret when critical environment variables are unset. This enables unauthenticated attackers to craft their own JWTs with chosen subject values, which can be accepted as valid authenticated identities. Consequently, this vulnerability poses a risk of user and workspace-owner impersonation, particularly when an attacker knows the target identifier. The issue has been addressed in the 0.1.6 release of the PraisonAI platform.

References