CVE-2026-34953 — praisonai
CRITICALCVE-2026-34953 is a critical-severity (CVSS 9.1) CWE-863 vulnerability in praisonai. A fix is available for praisonai — see the affected versions and patch details below.
PraisonAI: Authentication Bypass in OAuthManager.validate_token()
Exploitation Status
Proof-of-concept exploit code exists
- CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
- CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
Exploitation and automatability from CISA’s SSVC triage for CVE-2026-34953.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
praisonaiReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.
Description
Summary
OAuthManager.validate_token() returns True for any token not found in its internal store, which is empty by default. Any HTTP request to the MCP server with an arbitrary Bearer token is treated as authenticated, granting full access to all registered tools and agent capabilities.
Details
oauth.py:364 (source) -> oauth.py:374 (loop miss) -> oauth.py:381 (sink)
# source
def validate_token(self, token: str) -> bool:
for stored_token in self._tokens.values():
if stored_token.access_token == token:
return not stored_token.is_expired()
# sink -- _tokens is empty by default, loop never executes, falls through
return True
PoC
# install: pip install -e src/praisonai
# start server: praisonai mcp serve --transport http-stream --port 8080
curl -s -X POST http://127.0.0.1:8080/mcp \
-H "Authorization: Bearer fake_token_abc123" \
-H "Content-Type: application/json" \
-d '{"jsonrpc":"2.0","method":"tools/list","id":1}'
# expected output: 200 OK with full tool list (50+ tools)
# including praisonai.agent.run, praisonai.workflow.run, praisonai.containers.file_write
Impact
Any unauthenticated attacker with network access to the MCP HTTP server can call all registered tools including agent execution, workflow runs, container file read/write, and skill loading. The server binds to 0.0.0.0 by default with no API key required.
Suggested Fix
def validate_token(self, token: str) -> bool:
for stored_token in self._tokens.values():
if stored_token.access_token == token:
return not stored_token.is_expired()
# Unknown tokens must be rejected.
# For external/JWT tokens, call the introspection endpoint here before returning.
return False
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐍PyPI | praisonai | all versions | 4.5.97pip install --upgrade 'praisonai==4.5.97' |
Affected Products
praisonaipraisonDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for praisonai, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update praisonai to 4.5.97 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-34953 is resolved across your whole dependency graph.
Workarounds
Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used.
Frequently Asked Questions
Is CVE-2026-34953 in your dependencies?
Find it across PyPI, including transitive dependencies.