CVE-2026-40289 — AI Deep Analysis Summary

🚨 **Essence**: A critical Access Control Error in PraisonAI. 📉 **Consequences**: Unauthenticated remote session hijacking. Attackers can take over active sessions without permission.…

🔍 **Root Cause**: Missing authentication on the browser bridge. 🛡️ **Flaw**: Source checks are bypassable. 📌 **CWE**: CWE-306 (Improper Authentication). The security boundary between the browser and the app is broken.

👥 **Affected**: PraisonAI versions **< 4.5.139**. 📦 **Components**: `praisonaiagents` versions **< 1.5.140**. 🏢 **Vendor**: Mervin Praison. ⚠️ If you use older versions, you are vulnerable.

💻 **Privileges**: Full session control. 🕵️ **Data**: Access to all data within the hijacked session. 🚫 **No Auth Needed**: Attackers don't need credentials. They just need to trigger the bridge.

📉 **Threshold**: **LOW**. 🚀 **Exploitation**: Remote (AV:N). 🚫 **Auth**: None required (PR:N). 🙅 **UI**: No user interaction needed (UI:N). This is an easy target for automated attacks.

🚫 **Public Exp**: No PoC or wild exploits listed in data. 📝 **Status**: Advisory published. 🕵️ **Risk**: Despite no public code, the CVSS score is High (9.8). Theoretical exploitation is straightforward.

🔍 **Check**: Verify your PraisonAI version. 📊 **Scan**: Look for unauthenticated browser bridge endpoints. 🛡️ **Test**: Try accessing the bridge without valid session tokens. If it accepts, you are vulnerable.

✅ **Fixed**: Yes. 📦 **Patch**: Upgrade PraisonAI to **v4.5.139+**. 📦 **Patch**: Upgrade `praisonaiagents` to **v1.5.140+**. 📅 **Date**: Advisory released 2026-04-14.

🛡️ **Workaround**: Disable the browser bridge feature if possible. 🚫 **Network**: Restrict access to the application interface. 🧱 **Firewall**: Block external traffic to the bridge ports.…

🔥 **Urgency**: **CRITICAL**. 🚨 **Priority**: Patch immediately. 📈 **CVSS**: 9.8 (Critical). ⏳ **Time**: Zero-day risk is high. Do not delay updating your infrastructure.