CVE-2026-57122CWE-345CWE-347

CVE-2026-57122

High · published September 14, 2026

CVSS v3.1
8.6
EPSS
0%
Percentile
7.9
In the wild
Unconfirmed
What it is

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the WhatsApp and Linear bot webhook handlers verify HMAC signatures only when WHATSAPP_APP_SECRET or LINEAR_WEBHOOK_SECRET is configured and otherwise parse and dispatch unsigned request bodies. A remote unauthenticated client that reaches the webhook route can forge messages, comments, or agent-session events, impersonate platform users, influence agent prompts and actions, and disrupt bot processing. This issue is fixed in 4.6.59.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00188 · 7.9th percentile
Weaknesses
CWE-345 · Insufficient Verification of Data Authenticity; CWE-347 · Improper Verification of Cryptographic Signature
Published
2026-09-14T20:17Z
References (3)
https://github.com/MervinPraison/PraisonAI/commit/2adfe7e8323f6deec66925cf15a885b6238895e9 · [email protected]https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.59 · [email protected]https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-x92v-rpx6-p6cw · [email protected]
EPSS history
Timeline
  • 16 SEP 04:29Z
    EPSS moved — → 0%
    epss
  • 14 SEP 15:02Z
    PraisonAI: Webhook signature verification skipped (fail-open) when secret unset, allowing forged inbound webhooks (WhatsApp & Linear bots)
    cvelistv5