Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability exists because the praisonai-platform uses a hardcoded default JWT signing secret, dev-secret-change-me. This allows an attacker to forge JWT tokens and impersonate any user. The functions AuthService._issue_token and AuthService._verify_token are directly responsible for signing and verifying these tokens using the compromised secret. The security check in place to prevent the use of the default secret in production is flawed because it only triggers if the PLATFORM_ENV environment variable is explicitly set to a value other than 'dev'. In a default deployment, this variable is not set, and the check is bypassed, leaving the application vulnerable.
AuthService._issue_tokenpraisonai_platform/services/auth_service.py
AuthService._verify_tokenpraisonai_platform/services/auth_service.py
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| praisonai-platform | pip | <= 0.1.4 | 0.1.6 |