PYSEC-2026-3885 PraisonAI: [Auth Bypass] PraisonAI async Jobs API (`/api/v1/runs`) has no authentication — unauthenticated job execution, result theft, cancel and delete

Summary PraisonAI's async Jobs API the FastAPI service in praisonai/jobs/ installs its router with no authentication middleware, no router-level dependency, and no per-route auth check. Any caller who can reach the jobs server can submit agent jobs executed against the operator's configured LLM...

PraisonAI: [Auth Bypass] PraisonAI async Jobs API (`/api/v1/runs`) has no authentication — unauthenticated job execution, result theft, cancel and delete

SummaryPraisonAI's async Jobs API the FastAPI service in praisonai/jobs/ installs its router with no authentication middleware, no router-level dependency, and no per-route auth check. Any caller who can reach the jobs server can submit agent jobs executed against the operator's configured LLM...

PraisonAI: [Auth Bypass] PraisonAI async Jobs API (`/api/v1/runs`) has no authentication — unauthenticated job execution, result theft, cancel and delete

Summary PraisonAI's async Jobs API the FastAPI service in praisonai/jobs/ installs its router with no authentication middleware, no router-level dependency, and no per-route auth check. Any caller who can reach the jobs server can submit agent jobs executed against the operator's configured LLM...

EUVD-2026-65522

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, the Jobs API createapp function mounts /api/v1/runs without authentication. Any reachable caller can submit jobs, read results, cancel runs, or delete jobs using operator credentials. The fix adds PRAISONAIJOBSAPIKEY middleware f...

EUVD-2022-5455

Malicious code in bioql PyPI...

Exposure of Sensitive Information to an Unauthorized Actor in RESTEasy

RESTEasy allows remote authenticated users to obtain sensitive information by leveraging "insufficient use of random values" in async jobs...

CVE-2016-6345

RESTEasy allows remote authenticated users to obtain sensitive information by leveraging "insufficient use of random values" in async jobs...

DEBIAN-CVE-2016-6345

RESTEasy allows remote authenticated users to obtain sensitive information by leveraging "insufficient use of random values" in async jobs...

CVE-2016-6345

RESTEasy allows remote authenticated users to obtain sensitive information by leveraging "insufficient use of random values" in async jobs...

Design/Logic Flaw

RESTEasy allows remote authenticated users to obtain sensitive information by leveraging "insufficient use of random values" in async jobs...

CVE-2016-6345

RESTEasy allows remote authenticated users to obtain sensitive information by leveraging "insufficient use of random values" in async jobs...

CVE-2016-6345

RESTEasy allows remote authenticated users to obtain sensitive information by leveraging "insufficient use of random values" in async jobs...

CVE-2016-6345: Exposure of Sensitive Information to an Unauthorized Actor

RESTEasy allows remote authenticated users to obtain sensitive information by leveraging "insufficient use of random values" in async jobs...

CVE-2016-6345

It was found that there was insufficient use of randam values in RESTEasy async jobs. An attacker could use this flaw to steal user data. Mitigation Dont enable Async Jobs Service as details in the section, "2.10. RESTEASY ASYNCHRONOUS JOB SERVICE" of JBoss EAP 7 Developing Web Services...