CVE-2026-40289: PraisonAI Browser Server missing authentication enables WebSocket session hijacking
The browser bridge of PraisonAI and praisonaiagents exposes a /ws WebSocket endpoint without authentication, and its origin check is skipped when the Origin header is absent. A network attacker could take over connected browser extension sessions and receive their automation output. The issue is fixed in versions 4.5.139 and 1.5.140.
Overview
CVE-2026-40289 affects the browser bridge of PraisonAI and the praisonaiagents package. The bridge is started with the praisonai browser start command and exposes a WebSocket endpoint at /ws. According to the record, that endpoint has no authentication and an origin check that is skipped when the Origin header is missing.
Impact
- An unauthenticated network attacker may be able to take over a browser extension session connected to the bridge.
- Automation output and page context from the affected session could be exposed to the attacker.
- Model-backed browser actions could be misused in environments where the bridge is reachable from the network.
The record rates confidentiality and integrity impact as high and availability impact as none, with a CVSS base score of 9.1 and a CWE-306 classification.
Affected products and versions
- PraisonAI: before 4.5.139.
- praisonaiagents: before 1.5.140.
- The record lists the same two packages under both MervinPraison and Praison vendor names.
The record does not name any fixed version beyond the release numbers above.
Exploitation status
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog, and no confirmed active exploitation appears in the sources consulted. The SSVC exploitation value is recorded as proof-of-concept, and the advisory reference is tagged as an exploit resource, but that reference was not reviewed for this analysis.
Remediation and mitigation
- Upgrade PraisonAI to 4.5.139 or later, and praisonaiagents to 1.5.140 or later.
- Until upgrading is possible, do not expose the browser bridge to untrusted networks; restrict access to trusted hosts with host firewalls or network segmentation.
- Review whether browser automation sessions were connected while the bridge was reachable from untrusted networks.
- Rotate credentials or secrets that may have been visible in browser sessions or automation outputs if exposure cannot be ruled out.
Detection guidance
- Review network logs for inbound connections to the bridge WebSocket port from hosts that are not known automation clients.
- Look for WebSocket connections that carry no browser Origin header.
- Check whether browser extension sessions were reassigned or produced automation activity that the operator did not start.
These are high-level indicators; the record does not describe specific log formats.
Limitations of the available information
The record does not state the port number, the full list of affected configurations, or technical details of the fix. The EPSS date in the record is later than the publication date, and the reason is unknown. The analysis relies on the GitHub advisory reference and the NVD and CVE.org pages; no independent verification was performed.
Frequently asked questions
What is the core problem in CVE-2026-40289?
The browser bridge WebSocket endpoint at /ws does not require authentication, and its origin check is skipped when the Origin header is absent, so non-browser clients can connect.
Which versions are fixed?
The record says the issue is fixed in PraisonAI 4.5.139 and praisonaiagents 1.5.140. Earlier versions are listed as affected.
Is this CVE known to be actively exploited?
No. The record shows it is not in the CISA KEV catalog, and no confirmed active exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.