CVE-2026-47410

Summary of findings: CVE-2026-47410 affects PraisonAI Platform. When PLATFORM_JWT_SECRET is unset and PLATFORM_ENV remains default, the code uses a hardcoded secret dev-secret-change-me to sign and verify JWTs. This enables an attacker to forge tokens for arbitrary users and impersonate workspace...

PYSEC-2026-479 praisonai-platform: JWT signing key defaults to hardcoded "dev-secret-change-me", allowing token forgery for any user when PLATFORM_ENV is unset

Summary Type: Insecure default cryptographic key. The JWT signing secret defaults to the hardcoded literal "dev-secret-change-me" when PLATFORMJWTSECRET is unset. A safety check exists but only fires when PLATFORMENV != "dev"; the default value of PLATFORMENV is "dev", so the check is silently...

PT-2026-45064

Name of the Vulnerable Software and Affected Versions praisonai-platform affected versions not specified Description The software uses an insecure default cryptographic key for signing JSON Web Tokens JWT. When the PLATFORM JWT SECRET environment variable is unset, the system defaults to a...