CVE-2026-40289 Details
Description
PraisonAI is a multi-agent teams system. In versions below 4.5.139 of PraisonAI and 1.5.140 of praisonaiagents, the browser bridge (praisonai browser start) is vulnerable to unauthenticated remote session hijacking due to missing authentication and a bypassable origin check on its /ws WebSocket endpoint. The server binds to 0.0.0.0 by default and only validates the Origin header when one is present, meaning any non-browser client that omits the header is accepted without restriction. An unauthenticated network attacker can connect, send a start_session message, and the server will route it to the first idle browser-extension WebSocket (effectively hijacking that session) and then broadcast all resulting automation actions and outputs back to the attacker. This enables unauthorized remote control of connected browser automation sessions, leakage of sensitive page context and automation results, and misuse of model-backed browser actions in any environment where the bridge is network-reachable. This issue has been fixed in versions 4.5.139 of PraisonAI and 1.5.140 of praisonaiagents.
A vulnerability allowing unauthenticated remote session hijacking has been identified in PraisonAI versions prior to 4.5.139 and in praisonaiagents versions prior to 1.5.140. The issue arises in the browser bridge component, specifically at the '/ws' WebSocket endpoint, which lacks proper authentication and has a bypassable origin check. By default, the server listens on all network interfaces and only validates the Origin header when it is present. This oversight allows non-browser clients to connect without restrictions by omitting the header. Once connected, an attacker can send a 'start_session' message, which the server routes to the first available idle browser-extension WebSocket, effectively hijacking that session. The attacker then receives all automation actions and outputs from the extension, enabling unauthorized control over browser automation sessions, access to sensitive page context and automation results, and misuse of model-backed browser actions in any environment where the bridge is accessible over the network.
Users are advised to update to PraisonAI version 4.5.139 or later and to praisonaiagents version 1.5.140 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-8x8f-54wf-vv92 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| praison praisonai | < 4.5.139 |
CPE
Remediation
| |
| praison praisonaiagents | < 1.5.140 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 20, 2026 | Initial Analysis | [email protected] |
| Apr 14, 2026 | New CVE Received | [email protected] |