PraisonAI: Webhook signature verification skipped (fail-open) when secret unset, allowing forged inbound webhooks (WhatsApp & Linear bots)
Date: 2026-06
Affected: pip/praisonai
Attack vector: prompt-injection
Category: vulnerability-disclosure
Severity: High
CWE: CWE-345
CWE-347
CVSS: 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L)

The WhatsApp and Linear bot adapters verify the inbound webhook HMAC signature only when a secret is configured. When the secret environment variable is unset — the default on a fresh install and common in development — verification is skipped entirely and the webhook body is parsed and dispatched as a genuine, trusted event. A remote, unauthenticated attacker who can reach the bot's webhook endpoint can inject arbitrary platform events. Affected code: WhatsApp - src/praisonai/praisonai/bots/whatsapp.py - __init__ (line 108): self._app_secret = app_secret or os.environ.get("WHATSAPP_APP_SECRET", "") -> defaults to "" - route (line 246): app.router.add_post(self._webhook_path, self._handle_webhook) -> default path "/webhook" - _handle_webhook (lines 585-595): `if self._app_secret:` gates the ENTIRE check; when falsy the body is json.loads()'d and dispatched to _process_webhook_data() with no verification. Linear - src/praisonai/praisonai/bots/linear.py - __init__ (line 86): self._signing_secret = signing_secret or os.environ.get("LINEAR_WEBHOOK_SECRET", "") -> "" - _handle_webhook (lines 244-248): same `if self._signing_secret:` fail-open guard. - start() (lines 169-170): only logs a warning; does not fail closed. The _verify_signature implementations themselves are correct (constant-time HMAC-SHA256); the defect is that verification is bypassed when the secret is absent. Impact: - WhatsApp: attacker POSTs a crafted Meta Cloud API payload spoofing any sender and mess


Mitigations:

Architectural layers (MAESTRO):