Affected: MervinPraison PraisonAI

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the SSE server in src/praisonai-agents/praisonaiagents/server/server.py does not consult ServerConfig.auth_token before handling /publish, /events, or /info requests. A network client that can reach the server can broadcast arbitrary events to connected clients and obtain server configuration and client-count information. This issue is fixed in praisonaiagents 1.6.58.

Affected: PyPI: praisonaiagents

## Summary

The SSE (Server-Sent Events) server in `src/praisonai-agents/praisonaiagents/server/server.py` exposes a `/publish` endpoint that broadcasts arbitrary messages to all connected clients without any authentication. The `ServerConfig` dataclass (line 24) defines an `auth_token` field, but this token is never validated in the `/publish` or `/events` request handlers. Any attacker with access to the SSE server port can inject arbitrary events into the SSE stream visible to all connected clients, or use `/info` to leak server configuration including connected client count.

## Details

**Vulnerable code (lines 164–180):** ```python async def publish(request): try: data = await request.json() event_type = data.get("type", "message") event_data = data.get("data", {})

self.broadcast(event_type, event_data)

return JSONResponse({ "success": True, "clients": len(self._clients), }) ```

The `auth_token` field in `ServerConfig` (line 31): ```python @dataclass class ServerConfig: ... auth_token: Optional[str] = None ```

This `auth_token` is **never referenced** in any request handler. The `/publish` endpoint processes any POST request regardless of authentication headers. The `/info` endpoint (line 182) also has no auth and returns server configuration including `self.config.to_dict()`.

**Routes registration (lines 190–194):** ```python routes = [ Route("/health", health, methods=["GET"]…