CVE-2026-57148: 
Python vulnerability analysis and mitigation

CVE-2026-57148 is an incomplete fix vulnerability in the praisonai-platform Python package (PyPI) affecting versions <= 0.1.4, where the JWT signing secret remains hardcoded as "dev-secret-change-me" despite a prior patch attempt in GHSA-3qg8-5g3r-79v5. The original advisory declared version 0.1.4 as patched, but the fix merely duplicated the same default-open guard into a second function rather than failing closed, leaving all default deployments vulnerable. Discovered on 2026-05-30 and published as a GitHub Security Advisory (GHSA-f38v-77qj-h4jq) on 2026-06-17, the vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) (GitHub Advisory).

The root cause is classified under CWE-1188 (Insecure Default Initialization), CWE-798 (Use of Hard-coded Credentials), and CWE-287 (Improper Authentication). In services/auth_service.py, the module-level JWT_SECRET is set via os.environ.get("PLATFORM_JWT_SECRET", "dev-secret-change-me"), and the production guard only raises a RuntimeError when PLATFORM_ENV != "dev" — but PLATFORM_ENV itself defaults to "dev", so the guard never fires in a clean deployment. The 0.1.4 "fix" (GHSA-3qg8-5g3r-79v5) added an identical default-open guard to _issue_token rather than removing the fallback default, and _verify_token unconditionally trusts the sub claim of any JWT signed with the known default secret. A public PoC is included in the advisory demonstrating that the package's own AuthService._verify_token accepts a forged HS256 token signed with "dev-secret-change-me" in a default deployment (GitHub Advisory).

An unauthenticated attacker can forge a valid JWT for any arbitrary user ID using the publicly known default secret, achieving complete authentication bypass with no account or prior access required. If a target workspace owner's UUID is known (obtainable by any co-member via GET /{workspace_id}/members), the attacker can impersonate that owner and gain full read/update/delete access to all workspace resources, manage members and roles, and invoke DELETE /workspaces/{workspace_id} to irreversibly destroy the entire workspace — constituting high confidentiality, integrity, and availability impact. Every default deployment of praisonai-platform <= 0.1.4 that does not explicitly set PLATFORM_JWT_SECRET is affected, which is the documented default state (GitHub Advisory).

1. Identify target: Locate internet-facing instances of praisonai-platform (e.g., via Shodan searching for the default port 8000 with uvicorn/FastAPI banners) running version <= 0.1.4 without a custom PLATFORM_JWT_SECRET.
2. Obtain target user ID: If targeting a specific workspace owner, authenticate as any co-member (or exploit the bypass itself with a self-created sub) and call GET /{workspace_id}/members to retrieve user_id and role for all members.
3. Forge JWT: Using the publicly known default secret, mint an HS256 JWT with the desired sub (victim's UUID), a valid exp, and optional email/name claims:

   import jwt
   from datetime import datetime, timedelta, timezone
   now = datetime.now(timezone.utc)
   token = jwt.encode(
       {"sub": "<victim-uuid>", "email": "attacker@evil.com", "exp": now + timedelta(hours=1)},
       "dev-secret-change-me", algorithm="HS256"
   )

4. Authenticate as victim: Include the forged token in the Authorization: Bearer <token> header of any API request; the platform's _verify_token will accept it and return an authenticated AuthIdentity for the chosen sub.
5. Achieve objective: With owner-level access, read/modify/delete workspace resources, manage members and roles, or call DELETE /workspaces/{workspace_id} to destroy the entire workspace (GitHub Advisory).

• Network: Unexpected API calls to GET /{workspace_id}/members from IPs not associated with known users; authenticated requests to owner-gated endpoints (e.g., DELETE /workspaces/{workspace_id}, DELETE /{workspace_id}/members/{user_id}) from unfamiliar sources.
• Logs: JWT tokens in access logs with sub values not matching any registered user session; multiple authenticated requests from the same IP using different sub values; requests arriving without a preceding login/registration flow.
• Application Behavior: Unexpected workspace deletions, member evictions, or role changes not initiated by legitimate administrators; sudden loss of workspace resources with no corresponding admin activity in audit logs (GitHub Advisory).

Upgrade to praisonai-platform >= 0.1.5 (patched version per the advisory; the GitHub Advisory Database lists 0.1.6 as the patched version — use the latest available >= 0.1.5). As an immediate workaround for deployments that cannot upgrade, explicitly set the PLATFORM_JWT_SECRET environment variable to a strong, randomly generated value (e.g., export PLATFORM_JWT_SECRET=$(openssl rand -hex 32)) before starting the server — this is the only configuration change that prevents the default secret from being used. Additionally, set PLATFORM_ENV=prod to ensure the existing guard fires if the secret is somehow unset. Do not rely on version 0.1.4 as a security fix for GHSA-3qg8-5g3r-79v5 (GitHub Advisory).

The vulnerability was reported by security researcher Yanchon918s and published by the PraisonAI maintainer (MervinPraison) on June 17, 2026. The advisory explicitly calls out the failure of the prior patch (GHSA-3qg8-5g3r-79v5) and notes that users who upgraded to 0.1.4 specifically to address the original issue remain vulnerable — a particularly concerning scenario for the affected user base. No broader media coverage or notable social media discussion has been identified at this time (GitHub Advisory).