Skip to content

pentest-ai

v0.15.1 Bugfix

This release fixes issues for SREs watching stability and regressions.

Published 14d Offensive & Pentesting
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

ai-security bug-bounty claude ctf security exploit
+12 more
exploit-chaining hacking-tools mcp model-context-protocol nmap offensive-security osint penetration-testing pentest-ai pentesting python vulnerability-scanning

Affected surfaces

auth

Summary

AI summary

Fixes silent auth failure for bearer‑flow profiles using env password sources.

Changes in this release

Bugfix Medium

Fixes silent auth failure for bearer flow profiles with env password source.

Fixes silent auth failure for bearer flow profiles with env password source.

Source: llm_adapter@2026-05-25

Confidence: high

 —
Full changelog

Patch follow-up to 0.15.0 closing a silent auth failure on the headline flow: bearer profiles.

Fixed

  • MCP bearer-flow auth profile resolution (mcp_server/auth.py). Profiles declaring flow: bearer with password_source: env silently fell back to form-post: resolve_auth_profile_to_dict ignored prof.flow and returned a form_post dict for any password-source profile. Downstream POSTed form-encoded credentials to JSON-only endpoints like Juice Shop /rest/user/login and the login silently failed with auth_profile '<name>' could not be resolved or login failed. Adds a bearer_dynamic branch on both sides of the resolver. Two integration tests cover the dict shape and the async POST→JWT path. Validated end-to-end against Juice Shop v19.2.1 (8 phases completed, 100 findings, same 43/68 catch set as the 0.15.0 deterministic baseline).

Install

pip install ptai==0.15.1

PyPI: https://pypi.org/project/ptai/0.15.1/

Full notes in CHANGELOG.md.

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track pentest-ai

Get notified when new releases ship.

Sign up free

About pentest-ai

Offensive-security MCP server with 205 wrapped tools, 17 specialist agents, and 60 SPA-aware probes for OWASP Top 10. CLI + MCP, BYO LLM. No API key needed on MCP path.

All releases →

Related context

Beta — feedback welcome: [email protected]