PraisonAI’s /media-stream WebSocket endpoint allows any client to connect without authentication or Twilio signature validation. Each connection instantiates a session with OpenAI’s Realtime API using the server’s API key. Because there are no limits on concurrent connections, message rate or size, an attacker can use this path to exhaust server resources and drain the victim’s OpenAI API credits. The weakness is an uncontrolled resource consumption flaw (CWE‑770).

The vulnerability affects PraisonAI products from MervinPraison. All versions before 4.5.128 are impacted. The failure is in the media‑stream WebSocket call module, which is a core component of the multi‑agent teams system.

The CVSS score of 7.5 indicates high severity, and the lack of authentication makes exploitation trivial for anyone with network access to the server. Because the endpoint is public, attackers can mount large‑scale requests, potentially causing a denial‑of‑service condition and inflating cloud costs. The EPSS score is not available, and the vulnerability is not listed in the KEV catalog, but the high CVSS and remote unauthenticated nature make it a significant risk.