Saisathvik1

**Name of the Vulnerable Software and Affected Versions** PraisonAI versions prior to 4.6.58 **Description** In the serve subsystem, the `praisonai serve agents` and `praisonai serve unified` commands accept an `--api-key` flag for authentication, but the parsed value is not implemented within the FastAPI application. Consequently, the ` create agents app()` and ` create unified app()` functions fail to install a credential check, leaving the server open to unauthenticated access regardless of the key provided. This allows unauthorized callers to trigger agent workflows, potentially leading to API quota exhaustion or unauthorized tool and code execution depending on the agent configuration. **API Endpoints:** - `POST /agents` - `POST /agents/{name}` - `POST /api/v1/agents/{id}/invoke` - `GET /` - `GET / praisonai /discovery` **Vulnerable Parameters or Variables:** - `api key` **Recommendations** Update PraisonAI to version 4.6.58 or later.

**Name of the Vulnerable Software and Affected Versions** Navidrome versions prior to 0.54.1 **Description** Navidrome stores the JWT secret in plaintext in the navidrome.db database file under the property table. This practice introduces a security risk because anyone with access to the database file can retrieve the secret. The JWT secret is critical for the authentication and authorization system. If exposed, an attacker could forge valid tokens to impersonate users, including administrative accounts, and gain unauthorized access to sensitive data or perform privileged actions. **Recommendations** For versions prior to 0.54.1, update to version 0.54.1 to fix the vulnerability. As a temporary workaround, consider restricting access to the navidrome.db database file to minimize the risk of exploitation. Avoid storing sensitive data in plaintext and ensure the database file is adequately secured.