PraisonAI allowed any unknown bearer token to be accepted as valid, enabling attackers to authenticate without a valid token. The flaw originates in the OAuthManager.validate_token() method, which returns true for tokens not found in its internal store. Because the store is empty by default, any arbitrary token grants full access to all tools and agent capabilities. The weakness maps to CWE-863 and results in unauthorized access to sensitive functionality.

MervinPraison PraisonAI versions earlier than 4.5.97 are affected. The issue exists in the MCP server implementation before 4.5.97. Patching to version 4.5.97 or later removes the flaw.

The CVSS score of 9.1 indicates high severity. The EPSS is below 1%, suggesting low current exploitation probability, but the vulnerability is not listed in the CISA KEV catalog. The attack can be executed simply by sending an HTTP request with any bearer token over the network to the MCP server. Because token validation is missing, exploitation is trivial for an attacker with network access, potentially leading to full system compromise.