CVE-2026-40116

PraisonAI is a multi-agent teams system. Prior to 4.5.128, the /media-stream WebSocket endpoint in PraisonAI's call module accepts connections from any client without authentication or Twilio signature validation. Each connection opens an authenticated session to OpenAI's Realtime API using the server's API key. There are no limits on concurrent connections, message rate, or message size, allowing an unauthenticated attacker to exhaust server resources and drain the victim's OpenAI API credits. This vulnerability is fixed in 4.5.128.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-q5r4-47m9-5mc7	Exploit Vendor Advisory
https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-q5r4-47m9-5mc7	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:praison:praisonai:*:*:*:*:*:*:*:*

History

26 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) PraisonAI es un sistema de equipos multiagente. Anteriormente a la 4.5.128, el endpoint WebSocket /media-stream en el módulo de llamadas de PraisonAI acepta conexiones de cualquier cliente sin autenticación o validación de firma de Twilio. Cada conexión abre una sesión autenticada a la API en tiempo real de OpenAI utilizando la clave API del servidor. No hay límites en conexiones concurrentes, tasa de mensajes o tamaño de mensajes, permitiendo a un atacante no autenticado agotar los recursos del servidor y agotar los créditos de la API de OpenAI de la víctima. Esta vulnerabilidad se corrige en la 4.5.128.

Information

Published : 2026-04-09 22:16

Updated : 2026-10-26 22:10

NVD link : CVE-2026-40116

Mitre link : CVE-2026-40116

CVE.ORG link : CVE-2026-40116

JSON object : View

Products Affected

praison

praisonai

CWE

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2026-40116", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40116", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-14T14:42:36.529534Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "MervinPraison", "product": "PraisonAI", "versions": [{"status": "affected", "version": "< 4.5.128"}]}]}], "published": "2026-04-09T22:16:35.297", "references": [{"url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-q5r4-47m9-5mc7", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-q5r4-47m9-5mc7", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "PraisonAI is a multi-agent teams system. Prior to 4.5.128, the /media-stream WebSocket endpoint in PraisonAI's call module accepts connections from any client without authentication or Twilio signature validation. Each connection opens an authenticated session to OpenAI's Realtime API using the server's API key. There are no limits on concurrent connections, message rate, or message size, allowing an unauthenticated attacker to exhaust server resources and drain the victim's OpenAI API credits. This vulnerability is fixed in 4.5.128."}, {"lang": "es", "value": "PraisonAI es un sistema de equipos multiagente. Anteriormente a la 4.5.128, el endpoint WebSocket /media-stream en el m\u00f3dulo de llamadas de PraisonAI acepta conexiones de cualquier cliente sin autenticaci\u00f3n o validaci\u00f3n de firma de Twilio. Cada conexi\u00f3n abre una sesi\u00f3n autenticada a la API en tiempo real de OpenAI utilizando la clave API del servidor. No hay l\u00edmites en conexiones concurrentes, tasa de mensajes o tama\u00f1o de mensajes, permitiendo a un atacante no autenticado agotar los recursos del servidor y agotar los cr\u00e9ditos de la API de OpenAI de la v\u00edctima. Esta vulnerabilidad se corrige en la 4.5.128."}], "lastModified": "2026-10-26T22:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:praison:praisonai:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "56CDE5F5-B03C-4C3A-9A92-F61C9DFDA9B1", "versionEndExcluding": "4.5.128"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}