CVE-2026-57147

Name of the Vulnerable Software and Affected Versions praisonai-platform version 0.1.4

Description The software uses a hardcoded default secret dev-secret-change-me for signing JSON Web Tokens (JWT). A security guard intended to prevent the application from starting in production with this default secret is incorrectly implemented. The guard only triggers if the PLATFORM JWT SECRET is the default value AND the PLATFORM ENV variable is explicitly set to something other than dev. If both environment variables are left unset, the system defaults to dev mode and starts normally using the public secret.

An unauthenticated attacker can use this public secret to forge JWTs with arbitrary user identities, including administrative accounts. This allows the attacker to bypass authentication for all protected routes in the application, such as those managing workspaces, projects, agents, and user activity. The vulnerability is further exacerbated by the use of the HS256 algorithm with a key that is shorter than the recommended 32 bytes.

Technical details include:

Recommendations For version 0.1.4, set the PLATFORM JWT SECRET environment variable to a strong, random value of at least 32 characters. As a temporary mitigation, ensure that the PLATFORM ENV variable is explicitly set to a value other than dev to trigger the startup guard, although the primary fix is to provide a secure secret.