PraisonAI’s MCP HTTP Stream transport contains a flaw in its _validate_origin method: it accepts any request whose Origin header begins with an allowed prefix. Because the allowlist includes the string "localhost", an attacker can set the Origin to "localhost.evil.example", which passes the startswith check. Without an API key, a malicious webpage can then send tools/call requests to the local MCP server, causing the server to execute exposed tools on behalf of the victim. The vulnerability represents an authentication failure (CWE‑306) coupled with an authentication bypass by untrusted input (CWE‑346).

All installations of MervinPraison PraisonAI older than version 4.6.58 are vulnerable. The issue is fixed in 4.6.58 and later releases.

The CVSS base score is 6.9, indicating a moderate-level severity. EPSS data is not available, so the probability of exploitation is unknown, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a browser-mediated local request: a user visits a malicious webpage that sends an HTTP request to the local MCP server with a forged Origin header. If the MCP server is running on a workstation or internal machine that trusts its local interface, the attacker can cause arbitrary tools to run without authentication.