Is there a patch available for EUVD-2026-17393?

Yes, a patch is available for EUVD-2026-17393. Update the affected software to the latest version immediately.

Openclaw EUVD-2026-17393

Q: What is the CVSS score of EUVD-2026-17393?

EUVD-2026-17393 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-34508 MEDIUM

Improper Restriction of Excessive Authentication Attempts (CWE-307)

2026-03-31 VulnCheck

Authentication Bypass Openclaw

6.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

2026.3.12

EUVD ID Assigned

Mar 31, 2026 - 11:45 euvd

EUVD-2026-17393

Analysis Generated

Mar 31, 2026 - 11:45 vuln.today

CVE Published

Mar 31, 2026 - 11:17 nvd

MEDIUM 6.3

DescriptionCVE.org

OpenClaw before 2026.3.12 applies rate limiting only after webhook authentication succeeds, allowing attackers to bypass rate limits and brute-force webhook secrets without triggering 429 responses. Attackers can repeatedly guess invalid secrets to discover valid credentials and subsequently submit forged Zalo webhook traffic.

AnalysisAI

OpenClaw before version 2026.3.12 allows authenticated attackers to bypass rate limiting on webhook secret validation by exploiting a logic flaw that applies rate limits only after successful authentication, enabling brute-force attacks against webhook credentials and injection of forged Zalo webhook traffic. The vulnerability requires authenticated access but results in high-confidence credential compromise.

Technical ContextAI

OpenClaw implements webhook authentication via shared secrets (likely HMAC-based validation against Zalo's webhook delivery system). The vulnerability stems from improper order of operations in the authentication flow: rate-limit checks are performed after the secret validation succeeds, rather than before. This means an attacker with valid credentials to the platform itself can make unlimited authentication attempts against webhook endpoints using different secret guesses. The root cause is classified as CWE-307 (Improper Restriction of Rendered UI Layers or Frames), though this more accurately reflects a timing/ordering vulnerability in access control logic where expensive cryptographic validation occurs before rate-limit enforcement.

RemediationAI

Vendor-released patch: OpenClaw version 2026.3.12 or later. Administrators should update immediately via standard release channels. The patch relocates rate-limit enforcement to occur before webhook secret validation, preventing brute-force enumeration. As a temporary workaround, if immediate patching is not feasible, rate limiting can be applied at the network layer (reverse proxy, WAF) to restrict repeated webhook authentication attempts, or webhook secrets can be strengthened to high entropy (32+ random characters) to increase brute-force attack cost. For detailed remediation guidance, consult the vendor advisory at https://www.vulncheck.com/advisories/openclaw-webhook-rate-limiting-bypass-via-pre-authentication-secret-validation-2.