CVE-2026-57134: Praisonai Npm PraisonAI MCPSecurity Basic/OAuth Authentication Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-4qq2-2j2x-x62c",
  "modified" : "2026-07-20T21:27:02Z",
  "published" : "2026-06-18T14:25:17Z",
  "aliases" : [ "CVE-2026-57134" ],
  "summary" : "npm PraisonAI MCPSecurity Basic/OAuth authentication policies accept invalid credentials without validation",
  "details" : "## Summary\n\nThe published npm package `praisonai` exports an `MCPSecurity` helper described in source as:\n\n```text\nMCP Security - Authentication, authorization, and rate limiting\nProvides security policies for MCP servers.\n```\n\nIts `AuthMethod` type advertises five authentication methods:\n\n```ts\nexport type AuthMethod = 'none' | 'api-key' | 'bearer' | 'basic' | 'oauth';\n```\n\nThe authentication-policy evaluator, however, only validates credentials for `api-key` and `bearer`:\n\n```ts\nif (policy.auth.method === 'api-key' || policy.auth.method === 'bearer') {\n    const valid = policy.auth.validate\n        ? await policy.auth.validate(token)\n        : this.validateApiKey(token);\n\n    if (!valid) {\n        return { allowed: false, reason: 'Invalid credentials' };\n    }\n}\n\nreturn { allowed: true, context: { authenticated: true } };\n```\n\nFor `basic` and `oauth`, any non-empty `Authorization` header skips the supplied `validate` callback and returns allowed. A local PoV configures `auth.validate` to always return `false`; invalid `api-key` and `bearer` credentials are rejected, while invalid `basic` and `oauth` credentials are accepted without calling the validator.\n\nThis is a protection-mechanism failure in the exported npm MCP security helper. It is distinct from the separate issue that the npm `MCPServer` HTTP transport does not enforce authentication by default.\n\n## Technical Details\n\n`SecurityPolicy.auth` accepts both a method and a validator:\n\n```ts\nauth?: { method: AuthMethod; validate?: (token: string) => Promise<boolean> };\n```\n\n`extractToken()` parses both Bearer and Basic headers:\n\n```ts\nif (auth.startsWith('Bearer ')) {\n    return auth.slice(7);\n}\nif (auth.startsWith('Basic ')) {\n    return auth.slice(6);\n}\nreturn auth;\n```\n\nBut `evaluatePolicy()` only calls `policy.auth.validate()` for two methods:\n\n```ts\nif (policy.auth.method === 'api-key' || policy.auth.method === 'bearer') {\n    const valid = policy.auth.validate\n        ? await policy.auth.validate(token)\n        : this.validateApiKey(token);\n\n    if (!valid) {\n        return { allowed: false, reason: 'Invalid credentials' };\n    }\n}\n```\n\nThere is no validation branch for `basic` or `oauth`. After extracting any non-empty token, those methods fall through to the success return:\n\n```ts\nreturn { allowed: true, context: { authenticated: true } };\n```\n\n`check()` then ignores successful authentication context and returns a generic allowed result:\n\n```ts\nreturn { allowed: true, context: { authenticated: false } };\n```\n\nThat context propagation issue is secondary. The security-relevant flaw is that invalid Basic/OAuth credentials are allowed at all.\n\n### Why This Is Not Intended Behavior\n\nThis is not a claim that every `MCPSecurity` user must choose Basic or OAuth. The issue is that the API explicitly exposes those methods as authentication methods and accepts a validator callback for the policy, but the implementation does not call the validator for those methods.\n\nThe control cases prove the intended security behavior:\n\n- Missing Basic credentials are denied as `Authentication required`.\n- Invalid `api-key` credentials are denied as `Invalid credentials`.\n- Invalid `bearer` credentials are denied as `Invalid credentials`.\n\nThe only difference in the vulnerable cases is the selected advertised method. Invalid Basic/OAuth credentials should not become authenticated merely because the method is not listed in the two-method validation branch.\n\nThis also matches MCP authorization guidance. MCP servers acting as resource servers must validate received access tokens; receiving a token is not proof that it is valid or intended for the server.\n\n## PoV\n\nRun from a local reproduction checkout:\n\n```bash\nnode poc/pov_poc.js 1.7.1\n```\n\nThe PoV:\n\n1. Installs `npm:praisonai@1.7.1` into a temporary project with scripts disabled.\n2. Imports `MCPSecurity` from the package root.\n3. Creates one `authenticate` policy per method.\n4. Supplies an `auth.validate` callback that always returns `false`.\n5. Sends invalid `api-key`, `bearer`, `basic`, and `oauth` credentials.\n6. Confirms the missing-header Basic control is still denied.\n\nObserved output summary from `evidence/pov-npm-1.7.1.json`:\n\n```json\n{\n  \"package\": \"praisonai\",\n  \"version\": \"1.7.1\",\n  \"cases\": [\n    {\n      \"method\": \"api-key\",\n      \"validateCalls\": 1,\n      \"allowed\": false,\n      \"reason\": \"Invalid credentials\"\n    },\n    {\n      \"method\": \"bearer\",\n      \"validateCalls\": 1,\n      \"allowed\": false,\n      \"reason\": \"Invalid credentials\"\n    },\n    {\n      \"method\": \"basic\",\n      \"validateCalls\": 0,\n      \"allowed\": true\n    },\n    {\n      \"method\": \"oauth\",\n      \"validateCalls\": 0,\n      \"allowed\": true\n    },\n    {\n      \"method\": \"basic\",\n      \"authorizationHeaderPresent\": false,\n      \"validateCalls\": 0,\n      \"allowed\": false,\n      \"reason\": \"Authentication required\"\n    }\n  ],\n  \"controlsPass\": true,\n  \"vulnerable\": true\n}\n```\n\nThe PoV is local-only. It does not start a server, contact a third-party target, or use live credentials.\n\n## PoC\n\nThe PoV section above contains the local reproduction command, input, and decisive output.\n\n## Impact\n\nA downstream application that uses `MCPSecurity` to protect an HTTP MCP transport, gateway, or equivalent tool/resource endpoint can believe it has enabled Basic or OAuth authentication while accepting any non-empty `Authorization` header.\n\nDepending on the protected MCP tools and resources, this can allow an unauthenticated network caller to:\n\n- list protected tools or resources;\n- call tools that were intended to require authentication;\n- read protected MCP resources;\n- trigger agent/workflow actions exposed behind the security helper; and\n- bypass audit assumptions based on the configured validator.\n\nThis report does not claim that npm PraisonAI wires `MCPSecurity` into the default `MCPServer.startHttp()` path. It is a library-level authentication bypass in an exported security component intended to protect MCP servers.\n\n### Severity\n\nSuggested severity: High.\n\nRationale:\n\n- `AV`: the affected helper is intended to protect MCP server requests and equivalent HTTP security checks.\n- `AC`: a single non-empty Basic or OAuth-style Authorization header is sufficient when such a policy is configured.\n- `PR`: the bypass grants access without valid credentials.\n- `UI`: no maintainer or user interaction is required after deployment.\n- `S`: impact is within the PraisonAI-hosting service and its exposed MCP resources/tools.\n- `C`: protected MCP resources or tool outputs may be disclosed.\n- `I`: protected tool calls may perform state-changing actions depending on the registered tools; the score is conservative because the vulnerable helper is library-level and deployment-dependent.\n- `A`: the PoV does not demonstrate availability impact.\n\nIf a deployment protects high-impact write or execution tools with `MCPSecurity`, maintainers may reasonably score integrity higher.\n\n## Suggested Fix\n\nMake authentication evaluation fail closed for every advertised method.\n\nRecommended:\n\n1. For `authenticate` policies, call `policy.auth.validate(token)` whenever it is provided, regardless of `auth.method`.\n2. If no validator is provided, only fall back to `validateApiKey()` for `api-key` when that behavior is explicitly intended.\n3. For `bearer` and `oauth`, require a validator or a server-side token validation implementation; otherwise deny with a configuration error.\n4. For `basic`, decode the Basic credential safely and pass the decoded username/password or raw credential to a validator; if no validator exists, deny.\n5. Treat unknown or unsupported methods as denied, not allowed.\n6. Return authenticated context from `check()` after a successful authenticate policy instead of replacing it with `{ authenticated: false }`.\n7. Add regression tests proving invalid credentials are rejected for `api-key`, `bearer`, `basic`, and `oauth`, and that each configured validator is called.\n\nMinimal fail-closed shape:\n\n```ts\nif (policy.type === 'authenticate') {\n  if (!policy.auth) return { allowed: false, reason: 'Authentication policy is not configured' };\n\n  const token = request.headers ? this.extractToken(request.headers) : null;\n  if (!token) return { allowed: false, reason: 'Authentication required' };\n\n  if (policy.auth.validate) {\n    const valid = await policy.auth.validate(token);\n    return valid\n      ? { allowed: true, context: { authenticated: true } }\n      : { allowed: false, reason: 'Invalid credentials' };\n  }\n\n  if (policy.auth.method === 'api-key') {\n    return this.validateApiKey(token)\n      ? { allowed: true, context: { authenticated: true } }\n      : { allowed: false, reason: 'Invalid credentials' };\n  }\n\n  return { allowed: false, reason: 'Authentication validator required' };\n}\n```\n\n## Affected Package/Versions\n\n- Repository: `MervinPraison/PraisonAI`\n- Ecosystem: `npm`\n- Package: `praisonai`\n- Component: TypeScript MCP security helper `src/praisonai-ts/src/mcp/security.ts`\n- Published dist path: `node_modules/praisonai/dist/mcp/security.js`\n- Latest npm package validated: `1.7.1`\n- Current `origin/main` validated: `1ad58ca02975ff1398efeda694ea2ab78f20cf3e`\n- `src/praisonai-ts/package.json` at `origin/main`: `praisonai` `1.7.1`\n\nSuggested affected range:\n\n```text\nnpm:praisonai >= 1.5.1, <= 1.7.1\n```\n\nAll published npm `1.x` versions were swept locally:\n\n- `1.0.0` through `1.5.0`: the tested root export was unavailable or `MCPSecurity` was not exported as a constructor.\n- `1.5.1`, `1.5.2`, `1.5.3`, `1.5.4`, `1.6.0`, `1.7.0`, and `1.7.1`: vulnerable.\n\nThe package root re-exports this helper:\n\n```ts\nexport {\n  MCPClient, createMCPClient, getMCPTools,\n  MCPServer, createMCPServer,\n  MCPSession as MCPSessionManager, createMCPSession,\n  MCPSecurity, createMCPSecurity, createApiKeyPolicy, createRateLimitPolicy,\n  type MCPClientConfig, type MCPSession, type MCPTransportType,\n  type MCPServerConfig, type MCPServerTool,\n  type SecurityPolicy, type SecurityResult\n} from './mcp';\n```\n\n## Advisory History\n\nVisible PraisonAI advisories and prior submissions were checked. The closest public advisory is `GHSA-98f9-fqg5-hvq5` / `CVE-2026-34953`, but that issue is distinct:\n\n- `GHSA-98f9-fqg5-hvq5` affects the PyPI package and Python `OAuthManager.validate_token()`.\n- This report affects the npm package and TypeScript `src/praisonai-ts/src/mcp/security.ts`.\n- The prior issue accepts arbitrary Bearer tokens because an empty Python token store falls through to `True`.\n- This issue accepts invalid Basic/OAuth credentials because the TypeScript validator callback is never called for those advertised methods.\n- The affected ranges and patched surfaces are different.\n\nThe earlier npm `MCPServer` report is also distinct: it covers missing auth in the HTTP transport by default. This report covers a fail-open branch in the separate exported `MCPSecurity` helper when users attempt to add Basic/OAuth authentication.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "praisonai"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "1.5.1"
      }, {
        "fixed" : "1.7.2"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 1.7.1"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-4qq2-2j2x-x62c"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/MervinPraison/PraisonAI"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-287", "CWE-288", "CWE-863" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-06-18T14:25:17Z",
    "nvd_published_at" : null
  }
}