CVE-2026-57147: praisonai-platform signs logins with the public secret dev-secret-change-me
praisonai-platform 0.1.4 and earlier fall back to the hardcoded JWT secret dev-secret-change-me when PLATFORM_JWT_SECRET is unset, and the production guard is off because PLATFORM_ENV defaults to dev. Anyone can forge a token and act as any user or workspace owner. Fixed in 0.1.6.
What it is
praisonai_platform/services/auth_service.py assigns the public value dev-secret-change-me to JWT_SECRET when PLATFORM_JWT_SECRET isn't set. The production guard doesn't run when PLATFORM_ENV is also unset, because it defaults to dev.
A remote unauthenticated attacker can mint an HS256 token with any sub and email, and AuthService._verify_token() and the get_current_user dependency accept it on protected API routes, which allows user or workspace-owner impersonation.
CVE-2026-57148 (GHSA-f38v-77qj-h4jq) covers the same default-open guard in 0.1.4 and is fixed in the same release.
How to check
- Affected: praisonai-platform (PyPI) 0.1.4 and earlier.
- Check whether PLATFORM_JWT_SECRET is set to a long random value in your deployment.
How to fix
- Upgrade praisonai-platform to 0.1.6 or later.
- Set PLATFORM_JWT_SECRET to a strong random value and PLATFORM_ENV=production, which also invalidates any tokens signed with the default secret.
pip show praisonai-platform | grep -i version