27 matches found
PYSEC-2026-4259 PraisonAI: AgentMail webhook lacks signature verification, allowing unauthenticated message injection and sender spoofing
Summary PraisonAI's AgentMail bot, when run in webhook or hybrid mode, starts an aiohttp webhook server bound to 0.0.0.0 and processes inbound message.received events without verifying any signature/HMAC and without authentication. The sender address and message body are taken directly from the...
PYSEC-2026-4252 PraisonAI: AgentMail webhook mode accepts forged unsigned message.received events and invokes agents
AgentMail webhook mode accepts forged unsigned message.received events and invokes agents Summary praisonai AgentMail webhook mode exposes a public aiohttp webhook endpoint that accepts caller-controlled message.received JSON without verifying AgentMail's Svix webhook signatures, then dispatches...
PraisonAI: AgentMail webhook mode accepts forged unsigned message.received events and invokes agents
AgentMail webhook mode accepts forged unsigned message.received events and invokes agents Summary praisonai AgentMail webhook mode exposes a public aiohttp webhook endpoint that accepts caller-controlled message.received JSON without verifying AgentMail's Svix webhook signatures, then dispatches...
EUVD-2026-44642
PraisonAI: AgentMail webhook mode accepts forged unsigned message.received events and invokes agents...
GHSA-7C92-X8VG-4258 PraisonAI: AgentMail webhook mode accepts forged unsigned message.received events and invokes agents
AgentMail webhook mode accepts forged unsigned message.received events and invokes agents Summary praisonai AgentMail webhook mode exposes a public aiohttp webhook endpoint that accepts caller-controlled message.received JSON without verifying AgentMail's Svix webhook signatures, then dispatches...
PraisonAI: AgentMail webhook lacks signature verification, allowing unauthenticated message injection and sender spoofing
Summary PraisonAI's AgentMail bot, when run in webhook or hybrid mode, starts an aiohttp webhook server bound to 0.0.0.0 and processes inbound message.received events without verifying any signature/HMAC and without authentication. The sender address and message body are taken directly from the...
GHSA-QJ9C-59P6-8CGX PraisonAI: AgentMail webhook lacks signature verification, allowing unauthenticated message injection and sender spoofing
Summary PraisonAI's AgentMail bot, when run in webhook or hybrid mode, starts an aiohttp webhook server bound to 0.0.0.0 and processes inbound message.received events without verifying any signature/HMAC and without authentication. The sender address and message body are taken directly from the...
EUVD-2026-43177
PraisonAI: AgentMail webhook lacks signature verification, allowing unauthenticated message injection and sender spoofing...
PT-2026-107649
Name of the Vulnerable Software and Affected Versions praisonai versions 4.5.128 through 4.6.62 Description The AgentMail webhook mode in praisonai exposes a public aiohttp endpoint that accepts message.received JSON payloads without verifying Svix webhook signatures. This allows an attacker to...
GHSA-M64W-VFG6-36PH Duplicate Advisory: PraisonAI: AgentMail webhook mode accepts forged unsigned message.received events and invokes agents
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-7c92-x8vg-4258. This link is maintained to preserve external references. Original Description PraisonAI before 4.6.78 fails to verify Svix webhook signatures in AgentMail webhook mode, allowing unauthenticated...
Duplicate Advisory: PraisonAI: AgentMail webhook mode accepts forged unsigned message.received events and invokes agents
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-7c92-x8vg-4258. This link is maintained to preserve external references. Original Description PraisonAI before 4.6.78 fails to verify Svix webhook signatures in AgentMail webhook mode, allowing unauthenticated...
CVE-2026-61436
PraisonAI before 4.6.78 fails to verify Svix webhook signatures in AgentMail webhook mode, allowing unauthenticated attackers to forge message.received events. Attackers can send crafted JSON payloads to the webhook endpoint to invoke configured agents with arbitrary sender addresses and message...
CVE-2026-61436 PraisonAI before 4.6.78 Missing Webhook Signature Verification
PraisonAI before 4.6.78 fails to verify Svix webhook signatures in AgentMail webhook mode, allowing unauthenticated attackers to forge message.received events. Attackers can send crafted JSON payloads to the webhook endpoint to invoke configured agents with arbitrary sender addresses and message...
CVE-2026-61436 PraisonAI before 4.6.78 Missing Webhook Signature Verification
PraisonAI before 4.6.78 fails to verify Svix webhook signatures in AgentMail webhook mode, allowing unauthenticated attackers to forge message.received events. Attackers can send crafted JSON payloads to the webhook endpoint to invoke configured agents with arbitrary sender addresses and message...
CVE-2026-61436 PraisonAI before 4.6.78 Missing Webhook Signature Verification
PraisonAI before 4.6.78 fails to verify Svix webhook signatures in AgentMail webhook mode, allowing unauthenticated attackers to forge message.received events. Attackers can send crafted JSON payloads to the webhook endpoint to invoke configured agents with arbitrary sender addresses and message...
CVE-2026-61436
PraisonAI before 4.6.78 fails to verify Svix webhook signatures in AgentMail webhook mode, allowing unauthenticated attackers to forge message.received events. Attackers can send crafted JSON payloads to the webhook endpoint to invoke configured agents with arbitrary sender addresses and message...
PT-2026-60139
Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 4.6.78 Description In AgentMail webhook mode, the software fails to verify Svix webhook signatures. This allows unauthenticated attackers to forge message.received events by sending crafted JSON payloads to the...
CVE-2026-61436: Improper Authentication
PraisonAI before 4.6.78 fails to verify Svix webhook signatures in AgentMail webhook mode, allowing unauthenticated attackers to forge message.received events. Attackers can send crafted JSON payloads to the webhook endpoint to invoke configured agents with arbitrary sender addresses and message...
GHSA-4MP6-8448-9VGV Duplicate Advisory: PraisonAI: AgentMail webhook lacks signature verification, allowing unauthenticated message injection and sender spoofing
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-qj9c-59p6-8cgx. This link is maintained to preserve external references. Original Description PraisonAI AgentMail versions before 4.6.78 lack signature verification in webhook mode, allowing unauthenticated...
Duplicate Advisory: PraisonAI: AgentMail webhook lacks signature verification, allowing unauthenticated message injection and sender spoofing
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-qj9c-59p6-8cgx. This link is maintained to preserve external references. Original Description PraisonAI AgentMail versions before 4.6.78 lack signature verification in webhook mode, allowing unauthenticated...