GHSA-wrmq-9fc4-gwwjHigh· 8.8▾ TwilightDuplicate Advisory: Pairing-scoped device session could restore revoked node token authority
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
Last analysed / modified upstream
This advisory has been withdrawn because it is a duplicate of GHSA-q99w-vh6v-q3v7. This link is maintained to preserve external references.
OpenClaw before 2026.5.26 contains an authorization bypass vulnerability where a surviving pairing-scoped device session can re-establish node token authority after revocation. Attackers with a paired device can regain WebSocket node-level access without renewed approval, weakening revocation controls and maintaining unauthorized access longer than intended.
openclaw < 2026.5.26Refer to the advisory for the patched release.
Connected by shared product, vendor, weakness, or advisory.
GHSA-275c-xpvc-jgfwMediumOpenClaw: Slack and Zalo webhook secrets could remain active after secrets.reload
GHSA-4m3v-q747-pc6hMediumOpenClaw: Mattermost slash token revocation could lag until monitor refresh
CVE-2026-100554Medium· 4.2OpenClaw (npm package 'openclaw') versions >= 2026.5.12 and < 2026.8.1 do not immediately invalidate Canvas HTTP authorization when a paired node is revoked
GHSA-jw7v-5mp7-ghgmMedium· 8.5Duplicate Advisory: Browser CDP discovery could accept blocked WebSocket URLs
CVE-2026-62197Medium· 8.5OpenClaw: Browser CDP discovery could accept blocked WebSocket URLs
GHSA-c29c-2q9c-pc86HighOpenClaw: Slack allowFrom could bind to mutable display names