CVE-2026-61436 | BDVDB-2026-348745 Detail
MervinPraisonPraisonAI
Description#
PraisonAI before 4.6.78 fails to verify Svix webhook signatures in AgentMail webhook mode, allowing unauthenticated attackers to forge message.received events. Attackers can send crafted JSON payloads to the webhook endpoint to invoke configured agents with arbitrary sender addresses and message content.
Impact#
Per CVSS v3.1: confidentiality impact low, integrity impact high, availability impact low. Attack vector: network.
Weaknesses#
- CWE-287 Improper Authentication
References#
- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-7c92-x8vg-4258
- https://github.com/MervinPraison/PraisonAI/commit/846568c7a5d8ce9e71e56e4c213f027c04909753
- https://github.com/MervinPraison/PraisonAI/commit/2a855c470077c7d2e2479a575f7ef7f548d51c33
- https://www.vulncheck.com/advisories/praisonai-before-missing-webhook-signature-verification
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.