CVE-2026-47410: PraisonAI Platform JWT Hardcoded Secret Enables Unauthenticated Token Forgery

Vulnerability Overview

CVE-2026-47410 is a critical authentication bypass vulnerability (CVSS 9.8) in the praisonai-platform Python package. The root cause is a hardcoded JWT signing key: when the PLATFORM_ENV environment variable is unset, the platform defaults to signing all JSON Web Tokens with the literal string dev-secret-change-me (CWE-321 / CWE-798). Because the secret is publicly known, any unauthenticated attacker can craft a cryptographically valid JWT for an arbitrary user identity — including platform administrators — without ever knowing a real credential.

The impact is total platform compromise: privilege escalation to admin, access to all AI agent configurations, pipelines, and any data stored or processed by the platform.

Affected Software

• Package: praisonai-platform (PyPI)
• Affected versions: <= 0.1.2
• Vendor: pip ecosystem

No patched release has been published as of the detection authoring date. Operators should treat all deployments running version 0.1.2 or earlier as fully compromised until the PLATFORM_ENV variable is explicitly set and a strong, randomly generated secret is configured.

Exploitation Status

A public proof-of-concept is available. The barrier to exploitation is extremely low: an attacker needs only to sign a JWT payload of their choosing with the known string dev-secret-change-me using any standard JWT library. No memory corruption, no heap grooming, no race condition — just one HMAC-SHA256 call. Defenders should treat active exploitation as likely wherever this package is internet-exposed.

How Our Detection Catches It

Because no patch exists, detection is the primary control. Our coverage targets the observable side-effects of forged-token abuse rather than the signing event itself (which occurs entirely on the attacker's machine).

Detection Logic at a Glance

Across all seven SIEM platforms we ship rules for, the core logic looks for a consistent pattern:

• Authentication anomalies: JWT-authenticated requests that succeed for high-privilege roles from source IPs or user agents with no prior authentication history in the environment.
• Signature artefacts: HTTP request metadata indicating the token was signed with a weak or default key where the platform exposes token decode errors or admin-tier access from unenrolled principals.
• Privilege escalation sequences: A rapid transition from zero activity to administrative API calls (agent creation, pipeline modification, credential access) within a single session.

SIEM Coverage

Full detection rules are available for:

• Microsoft Sentinel — KQL analytic rule targeting SigninLogs and custom platform ingestion tables
• Splunk — SPL correlation search with risk-based alerting integration
• Elastic — EQL sequence rule correlating authentication and admin-action events
• IBM QRadar — AQL rule with custom property extraction for JWT claims
• Sumo Logic — CSE signal mapped to MITRE ATT&CK
• Google Chronicle — YARA-L 2.0 rule for UDM event correlation
• CrowdStrike Falcon — Custom Query Language (CQL) rule for endpoint and identity telemetry

Recommendations

• Immediately audit all deployments of praisonai-platform <= 0.1.2 and assume token integrity is broken.
• Set PLATFORM_ENV to a non-default value and configure a cryptographically random JWT secret (minimum 256 bits) at the application level.
• Rotate all existing sessions and API tokens issued by affected instances.
• Apply network controls to restrict platform exposure to authenticated internal networks until a patched release is available.

The full detection page — including all SIEM queries, MITRE ATT&CK mapping, and atomic test cases — is available at /detections/CVE-2026-47410.