What is the CVSS score of CVE-2026-28477?

CVE-2026-28477 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Openclaw are affected by CVE-2026-28477?

OpenClaw instances using the Chutes login flow are vulnerable to CSRF attacks due to improper OAuth state validation, potentially allowing attackers to hijack user sessions and gain unauthorized…. A patch is available.

How to fix or mitigate CVE-2026-28477?

Within 24 hours: Identify all OpenClaw deployments using Chutes manual login and assess user exposure. Within 7 days: Implement compensating controls (disable Chutes login if possible, enforce additional verification, apply WAF rules to detect CSRF patterns, or restrict access by IP/network). Within 30 days: Monitor vendor for patch release and establish timeline for immediate deployment once available; consider alternative authentication methods if Chutes cannot be secured.

Openclaw CVE-2026-28477

HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-03-05 disclosure@vulncheck.com

GHSA-7rcp-mxpq-72pj

CSRF Openclaw

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 22:16 nvd

HIGH 7.1

DescriptionCVE.org

OpenClaw versions prior to 2026.2.14 contain an oauth state validation bypass vulnerability in the manual Chutes login flow that allows attackers to bypass CSRF protection. An attacker can convince a user to paste attacker-controlled OAuth callback data, enabling credential substitution and token persistence for unauthorized accounts.

AnalysisAI

OpenClaw versions before 2026.2.14 fail to properly validate OAuth state parameters in the Chutes login flow, allowing attackers to bypass CSRF protections and hijack user sessions. An attacker can trick a user into pasting malicious OAuth callback data to gain unauthorized access and maintain persistent tokens under a compromised account. No patch is currently available for this high-severity vulnerability.

Technical ContextAI

Classified as CWE-352 (Cross-Site Request Forgery (CSRF)). Affects OpenClaw. OpenClaw versions prior to 2026.2.14 contain an oauth state validation bypass vulnerability in the manual Chutes login flow that allows attackers to bypass CSRF protection. An attacker can convince a user to paste attacker-controlled OAuth callback data, enabling credential substitution and token persistence for unauthorized accounts.