Threats affecting pkg:pypi/praisonai-platform

PraisonAI versions prior to 0.1.6 contain an improper authentication vulnerability where the system falls back to a public default signing key if the environment variable PLATFORM_JWT_SECRET is unset. This fallback, combined with disabled startup and token-issuance guards in the default dev environment, allows unauthenticated attackers to forge JWT tokens with arbitrary user identities. The vulnerability enables impersonation of users or workspace owners when their identifiers are known. This issue is fixed in version 0.1.6.