What is the CVSS score of CVE-2026-3691?

CVE-2026-3691 has a CVSS 3.0 base score of 5.3 (Medium). CVSS vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-3691?

Yes, a patch is available for CVE-2026-3691. Update the affected software to the latest version immediately.

Openclaw CVE-2026-3691

EUVD-2026-21623 MEDIUM

Information Exposure (CWE-200)

2026-04-11 zdi

Information Disclosure Openclaw

5.3

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 11, 2026 - 01:00 euvd

EUVD-2026-21623

Analysis Generated

Apr 11, 2026 - 01:00 vuln.today

CVE Published

Apr 11, 2026 - 00:17 nvd

MEDIUM 5.3

DescriptionCVE.org

OpenClaw Client PKCE Verifier Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose stored credentials on affected installations of OpenClaw. User interaction is required to exploit this vulnerability in that the target must initiate an OAuth authorization flow.

The specific flaw exists within the implementation of OAuth authorization. The issue results from the exposure of sensitive data in the authorization URL query string. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-29381.

AnalysisAI

OpenClaw Client exposes PKCE verifier and stored credentials through unencrypted OAuth authorization URL query strings, allowing remote attackers to disclose authentication data when users initiate OAuth flows. The vulnerability requires user interaction (target must start authorization), has a CVSS score of 5.3 (medium), and affects all versions of OpenClaw Client. No active exploitation has been publicly reported, though the ZDI designation (ZDI-CAN-29381) indicates coordinated disclosure.

Technical ContextAI

The vulnerability exists in OpenClaw's OAuth 2.0 authorization code flow implementation, specifically in how the PKCE (Proof Key for Code Exchange) verifier is handled. OAuth authorization URLs are transmitted over the network and often logged in browser history, server logs, and proxy records. By exposing sensitive data such as credentials or PKCE verifiers in query string parameters rather than using secure request body transmission or encrypted channels, attackers can intercept this information. The root cause is improper data protection (CWE-200: Information Exposure) during OAuth handshake construction. The CPE indicates the vulnerability affects OpenClaw across all versions (cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*), suggesting this is a fundamental flaw in the OAuth implementation rather than a recent regression.

RemediationAI

OpenClaw maintainers must immediately review and restructure OAuth authorization handling to move sensitive parameters (PKCE verifiers, state tokens, and any credential data) from URL query strings to secure request body payloads or encrypted channels. Users should update OpenClaw Client to the latest patched version once released by the project (consult GitHub security advisory GHSA-6g25-pc82-vfwp and ZDI advisory ZDI-26-229 for official release dates and versions). As an interim mitigation, users should avoid initiating OAuth flows over untrusted networks and consider using VPN or local proxies to encrypt network traffic. Administrators should audit OAuth-related logs and browser history for exposed credentials or PKCE verifiers and rotate any potentially disclosed authentication tokens.