PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI's call server exposes a network-facing agent control API without authentication when "CALL_SERVER_TOKEN" is not configured. The affected component is the "praisonai.api.agent_invoke" router as mounted by "praisonai.api.call". The authentication helper "verify_token()" fails open when "CALL_SERVER_TOKEN" is unset. Since every sensitive agent-control endpoint depends on this helper, starting the call server without a token allows any reachable client to list agents, inspect agent metadata and instructions, invoke agents, and unregister agents. This is security-relevant because the bundled call server includes the vulnerable router and binds to "0.0.0.0". As a result, operators who launch the call server without explicitly setting "CALL_SERVER_TOKEN" may unintentionally expose an unauthenticated remote agent control plane. Version 4.6.40 fixes the issue.