CVE-2026-57122

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the WhatsApp and Linear bot webhook handlers verify HMAC signatures only when WHATSAPPAPPSECRET or LINEARWEBHOOKSECRET is configured and otherwise parse and dispatch unsigned request bodies. A remote unauthenticated client that reaches the...

CVE-2026-57122 PraisonAI: Webhook signature verification skipped (fail-open) when secret unset, allowing forged inbound webhooks (WhatsApp & Linear bots)

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the WhatsApp and Linear bot webhook handlers verify HMAC signatures only when WHATSAPPAPPSECRET or LINEARWEBHOOKSECRET is configured and otherwise parse and dispatch unsigned request bodies. A remote unauthenticated client that reaches the...

EUVD-2026-77599

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the WhatsApp and Linear bot webhook handlers verify HMAC signatures only when WHATSAPPAPPSECRET or LINEARWEBHOOKSECRET is configured and otherwise parse and dispatch unsigned request bodies. A remote unauthenticated client that reaches the...

CVE-2026-57122

PraisonAI (a multi-agent LLM framework) is vulnerable to fail-open webhook signature verification in its WhatsApp and Linear bot adapters prior to 4.6.59 . When WHATSAPP_APP_SECRET or LINEAR_WEBHOOK_SECRET is unset—the default on a fresh install —the _handle_webhook handler skips HMAC-SHA256 veri...

CVE-2026-57122: Insufficient Verification of Data Authenticity

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the WhatsApp and Linear bot webhook handlers verify HMAC signatures only when WHATSAPPAPPSECRET or LINEARWEBHOOKSECRET is configured and otherwise parse and dispatch unsigned request bodies. A remote unauthenticated client that reaches the...

PraisonAI: Webhook signature verification skipped (fail-open) when secret unset, allowing forged inbound webhooks (WhatsApp & Linear bots)

The WhatsApp and Linear bot adapters verify the inbound webhook HMAC signature onlywhen a secret is configured. When the secret environment variable is unset — thedefault on a fresh install and common in development — verification is skipped entirelyand the webhook body is parsed and dispatched a...

GHSA-X92V-RPX6-P6CW PraisonAI: Webhook signature verification skipped (fail-open) when secret unset, allowing forged inbound webhooks (WhatsApp & Linear bots)

The WhatsApp and Linear bot adapters verify the inbound webhook HMAC signature only when a secret is configured. When the secret environment variable is unset — the default on a fresh install and common in development — verification is skipped entirely and the webhook body is parsed and dispatche...

PraisonAI: Webhook signature verification skipped (fail-open) when secret unset, allowing forged inbound webhooks (WhatsApp & Linear bots)

The WhatsApp and Linear bot adapters verify the inbound webhook HMAC signature only when a secret is configured. When the secret environment variable is unset — the default on a fresh install and common in development — verification is skipped entirely and the webhook body is parsed and dispatche...