CVE-2026-57147

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-57147

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-57147.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-57147

Aliases

Published

2026-09-15T10:34:16Z

Modified

2026-10-28T02:30:41Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

praisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgery

Details

PraisonAI is a multi-agent teams system. Prior to 0.1.6, praisonai_platform/services/auth_service.py assigns the public dev-secret-change-me value to JWT_SECRET when PLATFORM_JWT_SECRET is unset, and its production guard does not run when PLATFORM_ENV is also unset because that setting defaults to dev. A remote unauthenticated attacker can mint an HS256 token with an arbitrary sub and email, and the platform's AuthService._verify_token() and get_current_user dependency accept the forged identity for protected API routes. This vulnerability is fixed in praisonai-platform 0.1.6.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-1188",
        "CWE-798"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57147.json"
}

References

Affected packages

Git / github.com/mervinpraison/praisonai

Affected ranges

Type

GIT

Repo

https://github.com/mervinpraison/praisonai

Events

Introduced

Fixed

6878780000e8f9d9097b4d6a847f093e565ed509

Fixed

75b2afc2f336d282adccb8f2dbaaaf2deac969e1

Fixed

e0fb8e7dd1ee6759c18ed07f436c21dbd9c20747

Database specific

Show details

{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "4.6.51"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "0.1.6"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "e0fb8e7dd1ee6759c18ed07f436c21dbd9c20747"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v4.6.51",
            "range": [
                {
                    "fixed": "6878780000e8f9d9097b4d6a847f093e565ed509"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

0.*

0.0.55

0.0.56

0.0.57

0.0.59rc5

v0.*

v0.0.1

v0.0.18

v0.0.20

v0.0.21

v0.0.22

v0.0.23

v0.0.24

v0.0.25

v0.0.26

v0.0.27

v0.0.28

v0.0.29

v0.0.30

v0.0.31

v0.0.32

v0.0.33

v0.0.34

v0.0.35

v0.0.36

v0.0.37

v0.0.38

v0.0.39

v0.0.40

v0.0.41

v0.0.42

v0.0.43

v0.0.44

v0.0.45

v0.0.46

v0.0.47

v0.0.48

v0.0.49

v0.0.50

v0.0.51

v0.0.52

v0.0.53

v0.0.54

v0.0.58

v0.0.59

v0.0.59rc1

v0.0.59rc11

v0.0.59rc2

v0.0.59rc3

v0.0.59rc4

v0.0.59rc5

v0.0.59rc6

v0.0.59rc7

v0.0.59rc8

v0.0.59rc9

v0.0.61

v0.0.62

v0.0.63

v0.0.64

v0.0.65

v0.0.66

v0.0.67

v0.0.68

v0.0.69

v0.0.70

v0.0.71

v0.0.72

v0.0.73

v0.0.74

v0.1.0

v0.1.1

v0.1.2

v0.1.3

v0.1.4

v0.1.5

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-57147.json"