EUVD-2026-18849
GHSA-ch86-pxr9-j9h9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4Blast Radius
ecosystem impact- 5 npm packages depend on openclaw (5 direct, 0 indirect)
Ecosystem-wide dependent count for version 2026.4.2.
DescriptionCVE.org
OpenClaw before 2026.4.2 reuses the PKCE verifier as the OAuth state parameter in the Gemini OAuth flow, exposing it through the redirect URL. Attackers who capture the redirect URL can obtain both the authorization code and PKCE verifier, defeating PKCE protection and enabling token redemption.
AnalysisAI
OpenClaw before version 2026.4.2 reuses the PKCE verifier as the OAuth state parameter in Gemini OAuth flows, exposing cryptographic material through the redirect URL and enabling attackers who capture the URL to obtain both the authorization code and PKCE verifier, defeating PKCE protection and allowing unauthorized token redemption. The vulnerability requires user interaction (redirect capture) but has high confidentiality impact affecting OAuth security mechanisms; it is an information disclosure flaw in the OAuth implementation itself rather than a remote code execution threat.
Technical ContextAI
The vulnerability stems from a fundamental cryptographic protocol misuse in OAuth 2.0 with PKCE (Proof Key for Code Exchange). PKCE is a security extension designed to protect authorization code flows in public clients by requiring the client to prove possession of a secret verifier. The vulnerability (CWE-330: Use of Insufficiently Random Values) occurs because OpenClaw conflates two distinct OAuth parameters: the PKCE code_verifier (a secret cryptographic value meant to remain client-side) and the state parameter (a public anti-CSRF token). By reusing the verifier as the state value, it exposes this secret in the redirect URI visible in browser history, HTTP logs, and network captures. An attacker intercepting the redirect URL obtains both the authorization code and the PKCE verifier, allowing them to exchange the authorization code for tokens without knowing the original code challenge, completely bypassing PKCE's protection model.
RemediationAI
Vendor-released patch: OpenClaw 2026.4.2 or later. Users must upgrade to this version immediately to remediate the PKCE verifier exposure. The upstream fix is available in the GitHub commit a26f4d0f3ef0757db6c6c40277cc06a5de76c52f and detailed in the GitHub security advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-9jpj-g8vv-j5mf. No workarounds are available for earlier versions; patching is mandatory to restore OAuth security. Review application logs and token issuance records to identify any suspicious authorization activity during exposure period.
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
OpenClaw sandbox browser functionality launches x11vnc for noVNC observer sessions without requiring authentication, all
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
OpenClaw versions prior to 2026.3.1 contain a sandbox escape vulnerability that allows authenticated attackers with low
OpenClaw versions 2026.1.30 and below fail to validate Telegram webhook secret tokens when `channels.telegram.webhookSec
Same weakness CWE-330 – Use of Insufficiently Random Values
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today