PraisonAI’s A2U feature, which streams data between agents, suffers a flaw where the CLI wrapper does not enforce authentication when starting the server. The helper function that creates the A2U routes only verifies an authentication token if the environment variable A2U_AUTH_TOKEN is present; if the variable is missing, the authentication check is bypassed and the routes remain exposed. Consequently, anyone who can send HTTP requests to the exposed endpoints can subscribe to the event streams without providing valid credentials, potentially leaking internal state and operational data.

The vulnerability affects the MervinPraison PraisonAI application from version 4.5.115 up to, but not including, 4.6.61. The issue is triggered when users run the documented CLI entrypoint, which starts the server without the required authentication middleware. The problem was addressed in PraisonAI 4.6.61 and later releases.

The vulnerability carries a CVSS score of 7.5, indicating a high severity level. The EPSS score is not available and the CVE is not listed in CISA’s KEV catalog. Attackers can exploit the flaw by accessing the A2U subscription and event routes over the network if those endpoints are reachable, thereby gaining unauthenticated access to potentially sensitive event data.