PraisonAI multi-agent teams system contains an authentication bypass vulnerability in versions prior to 4.5.115. The A2U (Agent-to-User) event stream server exposes all agent activity without authentication checks. The create_a2u_routes() function registers multiple endpoints including /a2u/info, /a2u/subscribe, /a2u/events/{stream_name}, /a2u/events/sub/{id}, and /a2u/health without proper authentication. This allows unauthorized access to sensitive agent activity data. The vulnerability has been fixed in version 4.5.115.