Affected: MervinPraison PraisonAI

PraisonAI AgentMail versions before 4.6.78 lack signature verification in webhook mode, allowing unauthenticated attackers to inject messages with spoofed sender addresses. Attackers can POST crafted message.received events to the webhook endpoint to inject arbitrary content into the agent and trigger replies to attacker-controlled addresses, bypassing sender allow/block lists.

Affected: PyPI: praisonai

## Summary

PraisonAI's AgentMail bot, when run in webhook (or hybrid) mode, starts an aiohttp webhook server bound to `0.0.0.0` and processes inbound `message.received` events **without verifying any signature/HMAC and without authentication**. The sender address and message body are taken directly from the attacker-controlled request body, so any network peer can inject messages into the agent with a spoofed sender (bypassing sender allow/block lists) and have the agent process the content and reply to an attacker-chosen address. Sibling bots (`linear.py`, `whatsapp.py`) fail closed when no secret is configured; AgentMail omits the check entirely. Runtime-confirmed; severity Medium.

## Details

### Affected component - Package: `praisonai` 4.6.63. File: `src/praisonai/praisonai/bots/agentmail.py` (`AgentMailBot`, webhook/hybrid mode).

### Vulnerable code / root cause

Path: `src/praisonai/praisonai/bots/agentmail.py`

Function: `_start_webhook_mode` / `_handle_email_webhook` / `_handle_message`

Snippet: ```python # _start_webhook_mode: binds all interfaces self._webhook_site = web.TCPSite(self._webhook_runner, "0.0.0.0", self._webhook_port)

# _handle_email_webhook: no signature/HMAC check, no auth body = await request.json() if body.get("type") != "message.received": return web.Response(status=200, text="OK") asyncio.create_task(self._process_webhook_payload(body)) # dispatch attacker body return web.Response(status=200, text="OK")

# _handle_message: agent proce…