CVE-2026-47410
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
PraisonAI Platform versions prior to 0.1.4 use a hardcoded default JWT secret 'dev-secret-change-me' when PLATFORM_JWT_SECRET is unset. The safety check is bypassed because PLATFORM_ENV defaults to 'dev'. An attacker can read the secret from a public source file, forge a JWT with arbitrary claims, and authenticate as any user, including admins.
Risk Assessment
The organization is at risk of unauthorized system access, including takeover of admin and workspace owner accounts, potentially leading to full platform compromise.
Recommendation
Immediately upgrade PraisonAI Platform to version 0.1.4 and set a strong, unique JWT secret via the PLATFORM_JWT_SECRET environment variable.
Original NVD description (English source)
PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an insecure default cryptographic key. The JWT signing secret defaults to the hardcoded literal `"dev-secret-change-me"` when `PLATFORM_JWT_SECRET` is unset. A safety check exists but only fires when `PLATFORM_ENV != "dev"`; the default value of `PLATFORM_ENV` is `"dev"`, so the check is silently bypassed in any deployment that does not explicitly opt out. The attacker reads the literal from this public source file, mints a JWT with arbitrary `sub` and `email` claims, and authenticates as any existing user (including workspace owners and admins). PraisonAI Platform version 0.1.4 patches the issue.