Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
PraisonAI is a multi-agent teams system. Prior to version 4.5.97, OAuthManager.validate_token() returns True for any token not found in its internal store, which is empty by default. Any HTTP request to the MCP server with an arbitrary Bearer token is treated as authenticated, granting full access to all registered tools and agent capabilities. This issue has been patched in version 4.5.97.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-04-02 | 1 | Disclosure1 |
| 2026-04-03 | 1 | Patch1 |
| 2026-04-04 | 1 | Disclosure1 |
| 2026-04-06 | 1 | Disclosure1 |
[CVE-2026-34953: CRITICAL] PraisonAI's OAuthManager had a security flaw allowing unauthorized access via any token. Update to version 4.5.97 for the fix. #cybersecurity.#cve,CVE-2026-34953,#cybersecurity https://cvefind.com/CVE-2026-34953
Post summary
PraionAI's OAuthManager flaw permits unauthorized token access; applying the release 4.5.97 patch resolves the issue.
🚨 CVE-2026-34953: PraisonAI: Authentication Bypass... Default-empty token store means any Bearer header bypasses auth—instant RCE on multi-agent systems with zero effort req... https://zerodaysignal.com/vulnerability/CVE-2026-34953 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
CVE-2026-34953 exposes an authentication bypass in PraisonAI that permits immediate Remote Code Execution via any Bearer token. No patches or active exploitation reports are mentioned.
🔴 CVE-2026-34953 - Critical PraisonAI is a multi-agent teams system. Prior to version 4.5.97, OAuthManager.validate_token() returns True for any token not found in its internal store, which is empty by default. Any ... https://www.thehackerwire.com/vulnerability/CVE-2026-34953/ https://t.co/BdtYIkjJtW
Post summary
The article discloses that PraisionAI’s OAuthManager returned True for any unknown token until version 4.5.97, representing an authentication bypass, and indicates that later releases include a patch.
🚨 Critical PraisonAI flaw: CVE-2026-34953 An improper token validation issue could allow unauthorized access. Update now and follow recommended security practices. 🔗 https://vulert.com/vuln-db/CVE-2026-34953 #CyberSecurity #PraisonAI #CVE202634953 #Vulert https://t.co/38arQEKidH
Post summary
PraisonAI announced a critical token validation flaw (CVE‑2026‑34953) that could allow unauthorized access, urging users to update and follow security best practices.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | praison | praisonai | - | - | - |