EUVD-2026-33537
GHSA-g45j-9379-j77g
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was detected in unitedbyai droidclaw up to 0.5.3. The affected element is an unknown function of the file server/src/routes/pairing.ts of the component claim Endpoint. The manipulation results in improper restriction of excessive authentication attempts. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is described as difficult. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Missing brute-force protection on the claim endpoint in unitedbyai droidclaw (all versions up to 0.5.3) allows unauthenticated remote attackers to submit unlimited authentication attempts against the device pairing flow, potentially enumerating or compromising pairing credentials. The root cause is CWE-307 - absent rate limiting or lockout logic in server/src/routes/pairing.ts. A publicly available proof-of-concept exploit exists (hosted on GitHub Gist), though high attack complexity and low confidentiality impact constrain the real-world severity. No patch has been released; the vendor has not responded to the responsible disclosure filed via GitHub issue #14.
Technical ContextAI
droidclaw is a device-pairing server application by unitedbyai, likely designed for Android device management or remote control (CPE: cpe:2.3:a:unitedbyai:droidclaw:*:*:*:*:*:*:*:*). The vulnerable component is the claim endpoint defined in server/src/routes/pairing.ts, which handles the pairing authentication handshake. CWE-307 (Improper Restriction of Excessive Authentication Attempts) indicates the endpoint does not implement any form of rate limiting, account lockout, CAPTCHA, or exponential back-off to throttle repeated authentication submissions. This is a classic server-side authentication control deficiency, commonly exploited for credential enumeration or brute-force attacks against pairing tokens or PIN-style codes typical of device pairing protocols. The CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N) confirms the endpoint is reachable over the network without authentication, though successful exploitation requires high attack complexity - likely reflecting the need to guess or enumerate the pairing token format.
RemediationAI
No vendor-released patch has been identified at time of analysis; the maintainer has not responded to the GitHub issue disclosure. As an immediate compensating control, operators should implement network-level rate limiting on the /claim endpoint using a reverse proxy (e.g., nginx limit_req_zone or a WAF rule) to restrict the number of requests per source IP per time window - a threshold of 5-10 attempts per minute is a reasonable starting point, with a trade-off of potentially impacting legitimate pairing retries. If the pairing functionality is not actively in use or is only needed from trusted networks, restricting access to the claim endpoint via firewall ACL or IP allowlist is the most effective mitigation and carries minimal operational impact. Operators should also consider deploying application-level intrusion detection to alert on high-frequency POST patterns to the pairing route. For users who must run droidclaw in an internet-exposed context, disabling or proxying the claim endpoint until an upstream fix is available is strongly recommended. Monitor the upstream repository at https://github.com/unitedbyai/droidclaw/ for any patch releases.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today