PYPI · JUNE 2026 · EARLY WARNING

praisonai-platform PyPI Package: Default JWT Secret Vulnerability

EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.

GHSA-CWJ8-7GP2-GGCWSeverity: HIGH

The praisonai-platform package on PyPI is under investigation for a vulnerability involving a default JWT signing secret that may enable token forgery.

What happened

The praisonai-platform package, specifically version 0.1.4 on PyPI, appears to have a critical vulnerability tracked as GHSA-CWJ8-7GP2-GGCW. This vulnerability reportedly involves the use of a hardcoded JWT signing secret 'dev-secret-change-me', which is insecure and could enable token forgery. The issue is due to the insecure default initialization of a resource. Engineers using this package should assess their exposure by checking if they are running version 0.1.4 and whether they have set a strong random value for PLATFORM_JWT_SECRET in production. It is recommended to upgrade to a version where the default secret has been fixed or to manually set a strong random value for PLATFORM_JWT_SECRET. For more details, consult the primary source at https://github.com/advisories/GHSA-cwj8-7gp2-ggcw.

How 0Day mitigates this

MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If praisonai-platform is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Join the 0Day waitlist →

← Back to all threats