Authorization Bypass Vulnerability in OpenClaw: Revoked Node Token Authority Restoration
Summary
GHSA-wrmq-9fc4-gwwj: Duplicate Advisory: Pairing-scoped device session could restore revoked node token authority. Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenClaw is an open-source library designed for managing device sessions and token-based authorization in web applications. It allows devices to communicate securely with a server using WebSocket connections, ensuring that only authorized devices can access specific resources. However, a critical vulnerability has been identified in versions prior to 2026.5.26, which allows attackers to bypass authorization controls under certain conditions.
Vulnerability Detail
The vulnerability arises from an authorization bypass issue where a surviving pairing-scoped device session can re-establish node token authority after it has been revoked. This means that attackers who have previously paired a device can regain access to WebSocket node-level functionalities without needing renewed approval. As a result, revocation controls are weakened, allowing unauthorized access to persist longer than intended. The vulnerability is classified under CWE-613, indicating a failure to properly restrict access to sensitive resources.
How To Fix
No fixed version is published for this vulnerability.
To rectify this vulnerability, it is essential to update OpenClaw to version 2026.5.26 or later. You can update the package using npm by running the following command in your terminal: 'npm install openclaw@latest'. This will ensure that you are using the patched version that addresses the authorization bypass issue.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement additional checks in your application to verify the authorization status of devices before granting access to sensitive resources. This may involve maintaining a separate list of authorized devices and their statuses, ensuring that revoked devices cannot access the system.
Conclusion
The authorization bypass vulnerability in OpenClaw allows attackers to regain access to node-level functionalities after revocation, posing significant security risks. It is crucial to update to version 2026.5.26 or later to mitigate this issue. Implementing additional authorization checks can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for openclaw →
FAQ
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
All versions of OpenClaw prior to 2026.5.26 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By analyzing your package-lock.json file, Vulert can identify if your application is affected. You can also check using the Vulert playground without any signup.
If immediate updating is not possible, consider implementing additional authorization checks as a temporary workaround to mitigate the risk of unauthorized access.
Yes, due to the authorization bypass, there is a risk that unauthorized users may gain access to sensitive data and functionalities, potentially leading to data exposure.
Related vulnerabilities
Recent vulnerabilities recorded for openclaw.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.