CVE-2026-55528

**Researcher:** Kai Aizen — SnailSploit (@SnailSploit), Adversarial & Offensive Security Research **Target:** https://github.com/MervinPraison/PraisonAI --- **Package:** `praisonaiagents` on PyPI **Affected version (empirically tested):** 1.6.48 **Component:** `praisonaiagents.server.AgentServer` (the bundled HTTP / SSE server) --- ## TL;DR `AgentServer.ServerConfig` advertises an `auth_token: Optional[str] = None` field that operators set when they want to lock down the server. The `GET /info` endpoint even displays it back as `"auth_token": "***"` — strongly implying the value is wired into request authentication. It isn't. `AgentServer._create_app` never reads `auth_token`, never adds an authentication middleware, and never decorates any route with a dependency that checks it. Every route — `/info`, `/publish`, `/events`, `/health` — accepts unauthenticated requests regardless of whether `auth_token` is configured. The same package contains a *sibling* server, `praisonaiagents.ui.a2a.A2A`, written by the same developer, which implements the bearer-token pattern correctly via FastAPI's `Depends(_verify_auth)`. This rules out the "auth is not yet implemented; operators are expected to add it" reading: the developer knew the pattern but did not apply it to `AgentServer`. ## Root cause ``` Expected behavior when setting ServerConfig(auth_token="…"): "Only requests with a matching Authorization header will be accepted on /publish, /events, /info." Actual behavior (server/server.py, dist 1.6.48): - line 31 auth_token: Optional[str] = None # declared - line 39 "auth_token": "***" if self.auth_token else None # displayed - lines 122-204: no auth middleware, no Depends, no request.headers["Authorization"] read, no comparison to self.config.auth_token. Impact: The configuration knob is dead code from the route handlers' perspective. All routes always run. The o