What is CVE-2026-40116?

CVE-2026-40116 is a high-severity vulnerability in Mervinpraison Praisonai, classified under Allocation of Resources Without Limits or Throttling. CVSS score: 7.5/10. Published 2026-04-09.

How severe is CVE-2026-40116?

High severity. CVSS v3 base score is 7.5 out of 10.

Resource exhaustion in Mervinpraison Praisonai

CVE-2026-40116

PraisonAI is a multi-agent teams system. Prior to 4.5.128, the /media-stream WebSocket endpoint in PraisonAI's call module accepts connections from any client without authentication or Twilio signature validation. Each connection opens an authenticated session to OpenAI's Realtime API using the server's API key. There are no limits on concurrent connections, message rate, or message size, allowing an unauthenticated attacker to exhaust server resources and drain the victim's OpenAI API credits. This vulnerability is fixed in 4.5.128.

EPSS: 0.004 (29.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Affected products

Mervinpraison Praisonai — versions < 4.5.128
Praison Praisonai

Weakness classification (CWE)

CWE-770 — Allocation of Resources Without Limits or Throttling

References

security-advisories@github.com (x_refsource_CONFIRM, Exploit, Vendor Advisory)

Frequently asked questions

What is CVE-2026-40116?: CVE-2026-40116 is a high-severity vulnerability in Mervinpraison Praisonai, classified under Allocation of Resources Without Limits or Throttling. CVSS score: 7.5/10. Published 2026-04-09.
How severe is CVE-2026-40116?: High severity. CVSS v3 base score is 7.5 out of 10.