CVE-2026-57148

PraisonAI is a multi-agent teams system. Prior to 0.1.6, praisonaiplatform/services/authservice.py falls back to the public dev-secret-change-me HS256 signing key when PLATFORMJWTSECRET is unset, while the startup and token-issuance guards are disabled because PLATFORMENV also defaults to dev. An...

CVE-2026-57148

PraisonAI 's Python package praisonai-platform (versions ≤ 0.1.4, including the version GHSA-3qg8 incorrectly declared patched) ships a hardcoded JWT signing key ("dev-secret-change-me", HS256) in auth_service.py that is used whenever PLATFORM_JWT_SECRET is unset. The intended production guard is...

CVE-2026-57148 praisonai-platform 0.1.4 still boots on the hardcoded JWT secret dev-secret-change-me (default-open production guard)

PraisonAI is a multi-agent teams system. Prior to 0.1.6, praisonaiplatform/services/authservice.py falls back to the public dev-secret-change-me HS256 signing key when PLATFORMJWTSECRET is unset, while the startup and token-issuance guards are disabled because PLATFORMENV also defaults to dev. An...