Vibe Coding
PraisonAI's MCP auth policy validated credentials for api-key and bearer but waved through basic and OAuth
CVE-2026-57134, published 2026-09-15, scores 8.2. `MCPSecurity.evaluatePolicy()` in src/praisonai-ts/src/mcp/security.ts calls the configured credential validator only when AuthMethod is api-key or bearer; basic and OAuth policies accept any non-empty Authorization header without calling `auth.validate()` and return an authenticated result. Fixed in 1.7.2. The failure mode is worse than no auth because the policy reports success, so a config review sees an authenticated MCP surface that is not one.
Source
↳ Follow the thread