Authentication Bypass in PraisonAI Legacy Flask API Server

This repository is a local Docker lab and proof-of-concept for CVE-2026-44338, an authentication bypass affecting PraisonAI’s legacy Flask API server. It is not a weaponized exploit; it is a controlled reproduction showing that when authentication is disabled by default, unauthenticated callers can access GET /agents and POST /chat. The PoC in poc/poc.py sends unauthenticated HTTP requests to both endpoints on a vulnerable lab instance and a patched comparison instance, then classifies the target as LIKELY_VULNERABLE if both routes return HTTP 200 and expected response markers are present. Repository structure is simple: docker-compose.yml launches two containers, vuln and patched; vuln/start_server.py implements the fail-open behavior with AUTH_ENABLED = False; patched/start_server.py implements the fixed behavior with bearer-token enforcement; poc/poc.py is the main operator-facing script; README.md documents the CVE, affected versions, expected results, and references. Both server implementations use a DummyPraisonAI stub and agents.yaml string reference to simulate workflow execution without external side effects. Main exploit capability: unauthenticated access to legacy API routes over HTTP. On the vulnerable service, /agents discloses agent metadata and /chat accepts attacker-supplied JSON containing a message and reaches the workflow-trigger path without authentication. The patched service requires Authorization: Bearer lab-token and returns 401 otherwise. The exploit is best classified as a web/network POC for authentication bypass validation rather than post-exploitation code or RCE.

Small PoC repository for a PraisonAI authentication bypass advisory (GHSA-6rmh-7xcm-cpxj). The repository contains one primary Python script, a sample agents.yaml, and documentation/license files. The script does not exploit a remote target directly; instead, it stubs the praisonai module with a DummyPraisonAI class, ensures an agents.yaml file exists, dynamically loads src/praisonai/api_server.py from a local vulnerable PraisonAI checkout, and launches the Flask server on 0.0.0.0:8080. The intended demonstration is that authentication is disabled, allowing unauthenticated requests to endpoints such as /agents and /chat. This is a proof-of-concept web/network exploit for local testing of improper authentication exposure rather than a weaponized exploit. No reverse shell, persistence, or post-exploitation payload is included.