Affected: MervinPraison PraisonAI

PraisonAI is a multi-agent teams system. Prior to 4.6.62, setting PRAISONAI_CALL_AUTH to disabled makes verify_token accept requests to /api/v1/agents/{id}/invoke without CALL_SERVER_TOKEN authentication. Deployments that use the application's advertised opt-out can expose registered agents and their connected tools or private context to unauthenticated invocation. The vulnerability is fixed in 4.6.62.

Affected: PyPI: praisonai

### Summary Setting `PRAISONAI_CALL_AUTH=disabled` completely disables all authentication on the `/api/v1/agents/{id}/invoke` endpoint. This bypass is advertised in the application's own error messages, making it likely to appear in production Docker and Compose configurations.

### Details

```python # src/praisonai/praisonai/api/agent_invoke.py:32 _CALL_AUTH_DISABLED = os.getenv('PRAISONAI_CALL_AUTH', '').lower() == 'disabled'

async def verify_token(...) -> None: if _CALL_AUTH_DISABLED: return # all authentication skipped unconditionally ```

The application's own error message advertises the bypass: > "Set CALL_SERVER_TOKEN or PRAISONAI_CALL_AUTH=disabled to run without authentication."

This causes the setting to appear in Docker/Compose configurations as a convenience option.

### Proof of Concept

```python import os os.environ["PRAISONAI_CALL_AUTH"] = "disabled" # verify_token() now returns immediately for any request # POST /api/v1/agents/any-agent/invoke → 200 OK (no token needed) ```

Common vulnerable deployment:

```yaml # docker-compose.yml environment: - PRAISONAI_CALL_AUTH=disabled # auth completely disabled ```

### Impact Full unauthenticated access to the agent invocation API. Any agent registered on the server can be triggered without credentials, potentially executing arbitrary actions depending on the agent's configured tools.