CVE-2026-40116: 
Python vulnerability analysis and mitigation

CVE-2026-40116 is an unauthenticated WebSocket endpoint vulnerability in PraisonAI's call module that allows any remote attacker to exhaust server resources and drain the victim's OpenAI API credits without authentication. The /media-stream WebSocket endpoint accepts connections from any client without authentication or Twilio signature validation, and each connection automatically opens a paid session to OpenAI's Realtime API using the server's API key. All versions of PraisonAI prior to 4.5.128 (specifically <= 4.5.124) are affected. The vulnerability was published on April 9, 2026, and patched in version 4.5.128. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling). The vulnerability exists in src/praisonai/praisonai/api/call.py, where the FastAPI @app.websocket("/media-stream") handler at line 108 accepts any WebSocket connection without authentication middleware, Twilio X-Twilio-Signature header validation, or rate limiting. Upon each connection, the handler immediately opens an authenticated session to OpenAI's paid Realtime API (wss://api.openai.com/v1/realtime) using the server's OPENAI_API_KEY. The receive_from_twilio() coroutine then reads and forwards unlimited messages directly to OpenAI with no size or rate checks, and uvicorn.run() is called without a ws_max_size parameter, defaulting to 16MB per WebSocket message. The server binds to 0.0.0.0 and may be publicly exposed via ngrok. A public PoC consisting of two executable Python scripts is included in the GitHub Security Advisory (GitHub Advisory).

Successful exploitation results in three primary impacts: financial damage through OpenAI API credit drain (the Realtime API bills per second of audio, so an attacker streaming audio across many concurrent sessions can accumulate significant charges on the victim's OpenAI account), denial of service to legitimate Twilio callers when server resources such as memory and file descriptors are exhausted, and server memory exhaustion from unlimited concurrent connections each sending up to 16MB payloads. There is no confidentiality or integrity impact, but availability is fully compromised for the affected service (GitHub Advisory).

A public proof-of-concept exploit is available in the GitHub Security Advisory, consisting of two complete, runnable Python scripts using asyncio and websockets that connect to the target endpoint, send malformed Twilio events, and forward audio payloads to OpenAI to trigger billing and resource exhaustion. No authentication or special privileges are required — the attack is executable by any unauthenticated remote attacker with network access to the exposed endpoint. There is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.035% (0.000350), indicating low but non-zero probability of exploitation in the near term. The vulnerability is not currently listed in the CISA KEV catalog (GitHub Advisory).

1. Reconnaissance: Identify internet-facing PraisonAI instances running versions <= 4.5.124, particularly those exposed via ngrok or bound to 0.0.0.0 on port 8090. Tools like Shodan or Censys can be used to locate exposed WebSocket services.
2. Verify endpoint accessibility: Connect to ws://TARGET:8090/media-stream using a WebSocket client or the provided PoC script. Send a Twilio-style start event with an arbitrary streamSid value — no authentication is required.
3. Trigger OpenAI session: Send a media event with a base64-encoded audio payload. The server will immediately forward this to OpenAI's Realtime API using the server's OPENAI_API_KEY, confirming an active billed session.
4. Resource exhaustion: Open many concurrent WebSocket connections (e.g., 10–100+) using asyncio.gather(), each sending repeated large audio payloads (up to 16MB per message). Each connection spawns a separate OpenAI Realtime API session billed to the server owner.
5. Sustain attack: Keep sessions alive by continuously sending audio chunks (await asyncio.sleep(0.01) between sends), maximizing API billing charges and memory consumption until the server's resources or OpenAI rate limits are exhausted (GitHub Advisory).

• Network: Unusually high number of concurrent WebSocket connections to port 8090 (/media-stream endpoint) from unexpected or external IP addresses; outbound WebSocket connections from the PraisonAI server to wss://api.openai.com/v1/realtime at abnormally high frequency or volume.
• Logs: Server logs showing repeated "Client connected" and "Incoming stream has started" messages from non-Twilio IP addresses; high volume of OpenAI API requests in OpenAI usage dashboards indicating unexpected credit consumption.
• Process/Resource: Abnormal memory consumption by the PraisonAI/uvicorn process; high number of open file descriptors or network sockets associated with the service; CPU spikes correlating with large numbers of concurrent WebSocket sessions.
• Financial: Unexpected or rapidly increasing charges on the OpenAI account associated with the server's OPENAI_API_KEY, particularly for Realtime API usage (GitHub Advisory).

Upgrade PraisonAI to version 4.5.128 or later, which contains the official fix. As immediate workarounds prior to patching, implement Twilio X-Twilio-Signature header validation using twilio.request_validator.RequestValidator, enforce a maximum concurrent connection limit (e.g., MAX_CONCURRENT_CONNECTIONS = 20), and restrict WebSocket message size by passing ws_max_size=1_048_576 (1MB) to uvicorn.run(). Additionally, restrict network access to the /media-stream endpoint to known Twilio IP ranges using firewall rules, and avoid exposing the service publicly via ngrok unless strictly necessary (GitHub Advisory).