Insecure Default Initialization of Resource Affecting praisonai-platform package, versions [,0.1.6)

praisonai-platform is a Platform layer for PraisonAI — workspace, auth, issues, projects

Affected versions of this package are vulnerable to Insecure Default Initialization of Resource via the auth_service process. An attacker can gain unauthorized access to any user account, including workspace owners, by forging a JWT token using the publicly known default secret. This allows the attacker to impersonate users, access sensitive resources, and perform destructive actions such as deleting workspaces or removing legitimate members, all without prior authentication. This is only exploitable if the environment variable PLATFORM_JWT_SECRET is not explicitly set, as the default configuration leaves the application vulnerable.

• GitHub Advisory