PraisonAI, a multi‑agent team orchestration platform, ships a code generator that outputs a Flask API server. If users run the documented quickstart command `praisonai deploy --type api`, the generator creates a server that listens on all network interfaces (`0.0.0.0`), exposes `/chat` and `/agents` endpoints, and runs `praisonai.run()` on user‑supplied JSON data. Prior to release 4.6.40 the generator has `auth_enabled` set to `False` by default, meaning the resulting API server has no authentication mechanism. This flaw, classified as CWE‑1188 and CWE‑306, allows any host that can reach the server to send requests to the exposed endpoints without credentials, potentially allowing unauthorized access to the internal LLM orchestration, exposure of API keys that may be present in the process environment, or manipulation of system behavior.

All releases of PraisonAI produced by MervinPraison older than version 4.6.40 include the generator with auth_enabled defaulting to False. Users following the documented quickstart or the code‑generator directly are impacted. Version 4.6.40 and later correct the default behaviour, enabling authentication by default unless explicitly overridden.

The CVSS base score of 9.8 denotes a critical severity. The EPSS score of < 1% indicates a low probability of active exploitation at the current moment, and the issue is not listed in the CISA KEV catalogue. Based on the description, it is inferred that exploitation requires only that the vulnerable server is reachable; an attacker can send requests to the exposed endpoints and interact with the underlying LLM orchestration, potentially obtaining secret API keys or causing undesired operations. The condition is simple: run the deploy command with default settings and expose the server to the network. Because the server has no authentication, it permits unrestricted use, leading to potential data exposure and system compromise.