According to CoinMeta, the open-source proxy framework PraisonAI was released without authentication enabled. Less than 4 hours after the announcement GitHub was published on May 11, 2026, at UTC time 13:56, attackers began conducting exploratory tests. This vulnerability was tracked as CVE-2026-44338 with a CVSS score of 7.3, which is classified as a classic CWE-306 (critical functionality lacking authentication) flaw. The root cause lies in the legacy Flask API server within the PrasionAI Python package. Affected versions range from 2.5.6 to 4.6.33, where variables auth_enabled and auth_token are hardcoded to false and none, respectively, causing the check_auth() function to return true by default, making authentication completely optional. Security teams should monitor requests to /agents and/or chat, especially those lacking an authorization header.