EUVD-2026-25317
GHSA-w9f5-8q83-qwpx
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network WebSocket endpoint (AV:N), high complexity as practical impact requires weak shared password (AC:H), no auth needed to attempt (PR:N), limited credential confidentiality only (C:L).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
7Blast Radius
ecosystem impact- 1 npm packages depend on openclaw (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 2026.3.31.
DescriptionCVE.org
OpenClaw before 2026.3.31 contains an authentication rate limiting bypass vulnerability that allows attackers to circumvent shared authentication protections using fake device tokens. Attackers can exploit the mixed WebSocket authentication flow to bypass rate limiting controls and conduct brute force attacks against weak shared passwords.
AnalysisAI
Rate limiting bypass in OpenClaw's WebSocket gateway (npm package ≤ 2026.3.28) allows unauthenticated remote attackers to conduct unbounded brute-force attempts against shared-secret passwords by including a fake DeviceToken field in WebSocket handshake requests, suppressing the IP-based rate limiter. The maintainer's own triage classifies the practical risk as narrow, noting that only deployments relying on weak shared passwords face meaningful threat since high-entropy secrets remain non-bruteforceable regardless of rate limiting. No public exploit code exists, EPSS is 0.04%, and SSVC exploitation status is none - consistent with a low-priority patching target outside of weak-credential deployments.
Technical ContextAI
OpenClaw is an npm-distributed gateway/server product (CPE: cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*) whose WebSocket connection handler at src/gateway/server/ws-connection/auth-context.ts implements a mixed authentication flow supporting both shared-secret tokens and device-specific DeviceTokens. The root cause is CWE-799 (Improper Control of Interaction Frequency): the pre-fix conditional logic in resolveConnectAuthState passed rateLimiter: undefined to the shared-auth check whenever a DeviceToken candidate was detected in the request, regardless of whether shared-secret authentication was also being attempted. The commit diff confirms the precise logic error - the condition hasDeviceTokenCandidate ? undefined : params.rateLimiter was replaced with sharedAuthProvided ? params.rateLimiter : undefined - meaning an attacker-controlled DeviceToken field could wholly suppress brute-force attempt tracking for the shared-secret path.
RemediationAI
Upgrade the OpenClaw npm package to version 2026.3.31 or later - this is a released version confirmed by the GHSA advisory and VulnCheck report, containing fix commit af0c0862f22ca4492406a3103d05e3628f94cbe9. The advisory is at https://github.com/openclaw/openclaw/security/advisories/GHSA-6p8r-6m93-557f and the patch commit at https://github.com/openclaw/openclaw/commit/af0c0862f22ca4492406a3103d05e3628f94cbe9. If immediate upgrade is not possible, the most effective compensating control is rotating shared passwords to long, randomly generated, high-entropy values - the maintainer explicitly confirms that strong shared tokens remain non-bruteforceable even with rate limiting bypassed, eliminating practical risk without a code change. As a secondary control, deploying a reverse proxy or API gateway with its own WebSocket-layer rate limiting in front of OpenClaw can reduce unauthenticated brute-force throughput; note this adds operational dependency on the proxy's rate limit configuration. Operators who can disable the shared-secret WebSocket authentication mode entirely and rely solely on device-token authentication remove the vulnerable code path completely.
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
OpenClaw sandbox browser functionality launches x11vnc for noVNC observer sessions without requiring authentication, all
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
OpenClaw versions prior to 2026.3.1 contain a sandbox escape vulnerability that allows authenticated attackers with low
OpenClaw versions 2026.1.30 and below fail to validate Telegram webhook secret tokens when `channels.telegram.webhookSec
Same weakness CWE-799 – Improper Control of Interaction Frequency
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today