Which versions of Jwt Attack are affected by EUVD-2026-17013?

OpenClaw's Feistel webhook integration contains a critical authentication bypass (CVE-2026-32974) that allows unauthenticated attackers to inject forged events and trigger arbitrary downstream tool…. A patch is available.

How to fix or mitigate EUVD-2026-17013?

Within 24 hours: Inventory all OpenClaw instances and identify which deployments have webhook integrations enabled with verificationToken-only configuration (missing encryptKey). Within 7 days: For all affected instances, enable encryptKey alongside verificationToken in webhook settings and review webhook event logs for suspicious activity dated before remediation. Within 30 days: Upgrade to OpenClaw version 2026.3.12 or later once released; in interim, implement network-level restrictions limiting webhook endpoint access to known trusted sender IP ranges only.

Jwt Attack EUVD-2026-17013

Q: What is the CVSS score of EUVD-2026-17013?

EUVD-2026-17013 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-32974 HIGH

Improper Verification of Cryptographic Signature (CWE-347)

2026-03-29 VulnCheck

GHSA-vjqw-w5jr-g9w5

GHSA-g353-mgv3-8pcj

Authentication Bypass Jwt Attack

8.8

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch released

Apr 07, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Mar 29, 2026 - 13:15 euvd

EUVD-2026-17013

Analysis Generated

Mar 29, 2026 - 13:15 vuln.today

CVE Published

Mar 29, 2026 - 12:44 nvd

HIGH 8.8

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 npm packages depend on openclaw (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.3.12.

DescriptionCVE.org

OpenClaw before 2026.3.12 contains an authentication bypass vulnerability in Feishu webhook mode when only verificationToken is configured without encryptKey, allowing acceptance of forged events. Unauthenticated network attackers can inject forged Feishu events and trigger downstream tool execution by reaching the webhook endpoint.

AnalysisAI

Authentication bypass in OpenClaw's Feishu webhook integration (pre-2026.3.12) allows unauthenticated remote attackers to inject forged events and trigger arbitrary downstream tool execution. The vulnerability occurs when administrators configure only verificationToken without encryptKey, enabling attackers to craft malicious webhook payloads that bypass validation. No public exploit identified at time of analysis, though CVSS 8.8 reflects network accessibility (AV:N), zero complexity (AC:L), and no privileges required (PR:N).

Technical ContextAI

OpenClaw implements webhook integration with Feishu (ByteDance's enterprise collaboration platform) using two-tier security: verificationToken for basic request validation and encryptKey for cryptographic payload verification. The vulnerability stems from CWE-347 (Improper Verification of Cryptographic Signature), where the application accepts events authenticated only by verificationToken-a shared secret transmitted in cleartext-without enforcing encryptKey-based HMAC or digital signature verification. When encryptKey is omitted from configuration, attackers can forge valid-appearing webhook requests by simply including the verificationToken, which may be leaked through network traffic inspection, configuration exposures, or social engineering. The affected CPE (cpe:2.3:a:openclaw:openclaw) indicates this is a product-wide architecture flaw rather than version-specific regression.

RemediationAI

Upgrade to OpenClaw version 2026.3.12 or later, which enforces mandatory encryptKey validation for Feishu webhook requests. The patched version rejects webhook events lacking cryptographic signature verification, closing the authentication bypass vector. For environments unable to immediately upgrade, implement compensating controls: configure encryptKey parameter in webhook settings to enable HMAC-based payload authentication, restrict network access to webhook endpoints using firewall rules or reverse proxy ACLs permitting only Feishu server IP ranges, and enable request logging to detect anomalous webhook traffic patterns. Verify remediation by attempting webhook delivery with valid verificationToken but invalid or missing encryptKey-the application should reject the request post-patch. Consult vendor security advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-g353-mgv3-8pcj for configuration migration guidance and backward compatibility considerations when enabling encryptKey on existing deployments.