CVE-2026-47410

Critical

Description

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an insecure default cryptographic key. The JWT signing secret defaults to the hardcoded literal `"dev-secret-change-me"` when `PLATFORM_JWT_SECRET` is unset. A safety check exists but only fires when `PLATFORM_ENV != "dev"`; the default value of `PLATFORM_ENV` is `"dev"`, so the check is silently bypassed in any deployment that does not explicitly opt out. The attacker reads the literal from this public source file, mints a JWT with arbitrary `sub` and `email` claims, and authenticates as any existing user (including workspace owners and admins). PraisonAI Platform version 0.1.4 patches the issue.

SeverityCritical

CVSS9.8

Exploit probability—

ProductPraisonai-platform

PublishedJul 21, 2026

First seenJul 21, 2026

Weakness typeCWE-321CWE-321 CWE-798Hard-coded credentials

How to fix

Update

praisonai-platform0.1.4 or later

Affected products

Product	Affected versions	Fixed in
praisonai-platformPyPI	v < 0.1.4	0.1.4

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.