PraisonAI flaws allowed auth bypass and second-order SQL injection

PraisonAI, a multi-agent teams platform, disclosed two high-severity vulnerabilities affecting versions before 4.5.97 and 4.5.90. The more severe issue, tracked as CVE-2026-34953, stems from OAuthManager.validate_token() returning True for tokens missing from its internal store, which is empty by default. That logic flaw lets attackers present arbitrary Bearer tokens to authenticate to the MCP server and gain full access to registered tools and agent capabilities. The vulnerability was classified as CWE-863 with a CVSS v3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.

A second flaw, CVE-2026-34934, exposed PraisonAI to second-order SQL injection through get_all_user_threads. In affected versions before 4.5.90, the function constructed raw SQL queries with Python f-strings using unescaped thread IDs previously stored in the database, allowing an attacker to plant a malicious thread ID via update_thread and trigger injection when thread lists were loaded. The bug could lead to full database compromise and was classified as CWE-89 with a CVSS v3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; both issues were addressed in patched releases published through GitHub Security Advisories.