What is the CVSS score of CVE-2026-28477?

CVE-2026-28477 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Openclaw are affected by CVE-2026-28477?

OpenClaw instances using the Chutes login flow are vulnerable to CSRF attacks due to improper OAuth state validation, potentially allowing attackers to hijack user sessions and gain unauthorized…. A patch is available.

Openclaw CVE-2026-28477

HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-03-05 disclosure@vulncheck.com

GHSA-7rcp-mxpq-72pj

CSRF Openclaw

7.1

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 22:16 nvd

HIGH 7.1

DescriptionNVD

OpenClaw versions prior to 2026.2.14 contain an oauth state validation bypass vulnerability in the manual Chutes login flow that allows attackers to bypass CSRF protection. An attacker can convince a user to paste attacker-controlled OAuth callback data, enabling credential substitution and token persistence for unauthorized accounts.

AnalysisAI

OpenClaw versions before 2026.2.14 fail to properly validate OAuth state parameters in the Chutes login flow, allowing attackers to bypass CSRF protections and hijack user sessions. An attacker can trick a user into pasting malicious OAuth callback data to gain unauthorized access and maintain persistent tokens under a compromised account. …

RemediationAI

Within 24 hours: Identify all OpenClaw deployments using Chutes manual login and assess user exposure. Within 7 days: Implement compensating controls (disable Chutes login if possible, enforce additional verification, apply WAF rules to detect CSRF patterns, or restrict access by IP/network). …

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

CVE-2026-28477 vulnerability details – vuln.today

Back