CVE-2026-57147 Details

A vulnerability exists in the PraisonAI platform's authentication service, specifically in versions prior to 0.1.6. The issue arises because the default JWT secret is set to a public value, 'dev-secret-change-me', when the 'PLATFORM_JWT_SECRET' environment variable is not defined. Additionally, the application does not properly enforce production settings when 'PLATFORM_ENV' is unset, allowing the default secret to be used inappropriately. This misconfiguration enables remote, unauthenticated attackers to create JWTs with arbitrary user identifiers and email addresses. The forged tokens are accepted by the platform's authentication verification methods, granting access to protected API routes.

Users should update to PraisonAI platform version 0.1.6 or later, where this vulnerability has been addressed. In production environments, ensure that 'PLATFORM_JWT_SECRET' is set to a strong, random value and that 'PLATFORM_ENV' is explicitly defined as 'production'.