PraisonAI’s browser bridge (praisonai browser start) has an authentication bypass on its /ws WebSocket endpoint. The server binds to 0.0.0.0 by default and accepts any client that omits an Origin header; no authentication is required. An attacker can connect, send a start_session message, and the server will route the request to the first idle browser‑extension WebSocket, effectively hijacking that session. This allows the attacker to control a connected browser automation session, view or modify page content, and capture automation output, leading to unauthorized remote control and leakage of sensitive data.

The vulnerability affects the PraisonAI platform and praisonaiagents. Versions prior to 4.5.139 of PraisonAI and prior to 1.5.140 of praisonaiagents are vulnerable. Later versions contain a fix.

The CVSS score is 9.1, indicating a critical severity. Explicit EPSS data is unavailable, and it is not listed in CISA’s KEV catalog. The vulnerability can be exploited by any network attacker who can reach the WebSocket endpoint; no credentials or special privileges are required. The attack path is straightforward: open a WebSocket connection to /ws, send start_session, and assume control. Because the service listens on all interfaces, threat exposure is high, especially in environments where the bridge is publicly reachable.