praisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgery

praisonai-platform: default JWT signing secret dev-secret-change-meResearcher: Kai Aizen — SnailSploit @SnailSploit, Adversarial & Offensive Security ResearchTarget: https://github.com/MervinPraison/PraisonAI---Package: praisonai-platform on PyPILatest version and version tested: 0.1.4, current a...

CVE-2026-47410

Summary of findings: CVE-2026-47410 affects PraisonAI Platform. When PLATFORM_JWT_SECRET is unset and PLATFORM_ENV remains default, the code uses a hardcoded secret dev-secret-change-me to sign and verify JWTs. This enables an attacker to forge tokens for arbitrary users and impersonate workspace...