External risk intelligence

PraisonAI OAuthManager Authentication Bypass Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-34953

PraisonAI functions as a multi-agent systems framework providing an MCP (Model Context Protocol) server. Such interfaces act as application-layer gateways or service endpoints intended to expose agent capabilities and tools, which are commonly deployed as network-accessible services in environments where agents interact with external data or clients.

Praisonai

before 4.5.97

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in PraisonAI's token validation could allow unauthenticated access to agent capabilities and tools by sending arbitrary bearer tokens. This issue has been addressed in version 4.5.97.

Unauthenticated access to agent tools.
Crucial for systems with external integrations.
Confirm PraisonAI usage and exposure.

Attack Path

How an attacker could exploit the issue

An attacker can target the PraisonAI system by sending any HTTP request to its MCP server with a fake Bearer token. The system incorrectly validates these tokens, allowing unauthenticated access to all its tools and agent capabilities. This vulnerability can lead to unauthorized access and control over the system's functionalities.

Unauthenticated network access is required.
Any HTTP request with an arbitrary Bearer token triggers it.
Results in full unauthorized access.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, an unauthorized actor could send any HTTP request to the MCP server with an arbitrary Bearer token, bypassing authentication. This grants full access to all registered tools and agent capabilities.

Unauthenticated access to agent tools.
Requests with any Bearer token accepted.
Full access to agent capabilities.

Operational Fix

Recommended remediation, mitigation, and detection steps

The PraisonAI multi-agent system's MCP server is vulnerable to unauthenticated access due to improper token validation. This critical issue requires immediate attention from platform or application owners responsible for the PraisonAI deployment. The first step is to identify all instances of PraisonAI, confirm their network exposure and business criticality, and then engage the appropriate teams to plan remediation.

Platform or application owners should lead remediation.
Verify MCP server network exposure and criticality.
Plan and execute the upgrade to version 4.5.97.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is PraisonAI?

PraisonAI is a framework designed to build and manage multi-agent systems. It allows users to orchestrate autonomous agents that can work together to perform complex tasks. By providing a Model Context Protocol (MCP) server, it acts as a gateway that exposes these agent capabilities and specialized tools for interaction with other systems or data sources.

How does CVE-2026-34953 work?

This vulnerability is an instance of Improper Authorization (CWE-863). The system's OAuthManager fails to verify tokens correctly. Because the internal store is empty by default, the validation logic incorrectly treats any provided token as valid. This flaw allows unauthorized users to bypass security checks and gain full access to the system's tools and agent functions without proving their identity.

What triggers this authentication bypass?

An attacker can trigger this flaw by sending an HTTP request to the MCP server containing any arbitrary Bearer token. The system does not require a valid, pre-registered token to grant access. Note that this bug relies on the system's default behavior of treating an empty or unrecognized token as authenticated; simply having no token at all or a legitimate, previously configured token (if one were set up) would not bypass the logic in the same way.

Why is this CVE significant for my network?

According to Halo Surface Signal, PraisonAI instances often function as network-accessible services to facilitate agent interactions. If your deployment is exposed to the internet or reachable by untrusted users, this vulnerability is critical. It allows anyone who can reach the MCP server to take control of your agents and tools, meaning the risk depends heavily on whether the service is intended for internal-only use or broader external connectivity.

How do I secure my PraisonAI deployment?

The most effective way to resolve this is to upgrade your software to version 4.5.97 or later, which contains the fix for the token validation logic. Start by auditing your environment to identify all running instances of PraisonAI. Once you have confirmed your deployment and evaluated its network access, coordinate with your technical team to apply the update immediately to close the authentication gap.

References

github.com/MervinPraison/PraisonAI/security/advisories/GHSA-98f9…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.