CVE-2026-34953

PraisonAI is a multi-agent teams system. Prior to version 4.5.97, OAuthManager.validate_token() returns True for any token not found in its internal store, which is empty by default. Any HTTP request to the MCP server with an arbitrary Bearer token is treated as authenticated, granting full access to all registered tools and agent capabilities. This issue has been patched in version 4.5.97.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-98f9-fqg5-hvq5	Exploit Vendor Advisory
https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-98f9-fqg5-hvq5	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:praison:praisonai:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-04-03 23:17

Updated : 2026-07-24 22:10

NVD link : CVE-2026-34953

Mitre link : CVE-2026-34953

CVE.ORG link : CVE-2026-34953

JSON object : View

Products Affected

praison

praisonai

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-34953", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34953", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-06T16:04:51.198257Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "MervinPraison", "product": "PraisonAI", "versions": [{"status": "affected", "version": "< 4.5.97"}]}]}], "published": "2026-04-03T23:17:06.653", "references": [{"url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-98f9-fqg5-hvq5", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-98f9-fqg5-hvq5", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "PraisonAI is a multi-agent teams system. Prior to version 4.5.97, OAuthManager.validate_token() returns True for any token not found in its internal store, which is empty by default. Any HTTP request to the MCP server with an arbitrary Bearer token is treated as authenticated, granting full access to all registered tools and agent capabilities. This issue has been patched in version 4.5.97."}, {"lang": "es", "value": "PraisonAI es un sistema de equipos multiagente. Antes de la versi\u00f3n 4.5.97, OAuthManager.validate_token() devuelve True para cualquier token no encontrado en su almac\u00e9n interno, el cual est\u00e1 vac\u00edo por defecto. Cualquier solicitud HTTP al servidor MCP con un token Bearer arbitrario se trata como autenticada, otorgando acceso completo a todas las herramientas registradas y capacidades de agente. Este problema ha sido parcheado en la versi\u00f3n 4.5.97."}], "lastModified": "2026-07-24T22:10:00.140", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:praison:praisonai:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7525B4ED-CECC-4805-8EED-C055561A15F0", "versionEndExcluding": "4.5.97"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}