OAuth State Validation Bypass in OpenClaw Chutes Leading to Credential Substitution
Summary
GHSA-7rcp-mxpq-72pj: OpenClaw Chutes manual OAuth state validation bypass can cause credential substitution. Affects openclaw versions < 2026.2.14. Fixed in 2026.2.14. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenClaw is an open-source package designed for managing OAuth authentication flows in applications. It provides a streamlined way for users to log in using third-party services. However, a vulnerability has been identified in the manual Chutes OAuth login flow, which could allow attackers to exploit the system by bypassing critical state validation mechanisms.
Vulnerability Detail
The vulnerability arises from the manual Chutes OAuth login flow, which improperly accepts attacker-controlled callback input. This flaw allows an attacker to bypass OAuth CSRF state validation, potentially leading to credential substitution. If a user is tricked into pasting malicious OAuth callback data, OpenClaw may exchange an authorization code obtained by the attacker, resulting in the persistence of tokens for an unintended Chutes account. This issue is particularly concerning as it compromises user credentials and account security.
How To Fix
Latest published version: 2026.10.6 as of 22 Oct 2026
npm install openclaw@2026.10.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2026.2.14
This is the first release that contains the fix.
npm install openclaw@2026.2.14Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users should avoid using the manual Chutes OAuth login flow until they can update to the patched version. Additionally, users should be cautious about pasting any OAuth callback data and ensure they are using the automatic local callback flow, which is not affected by this vulnerability.
Conclusion
In summary, the OpenClaw package has a vulnerability in its manual Chutes OAuth login flow that can lead to credential substitution due to improper state validation. Users are advised to update to version 2026.2.14 or later to mitigate this risk. Until then, they should avoid using the affected login method.
See every vulnerability recorded for openclaw →
FAQ
The vulnerability allows attackers to bypass OAuth CSRF state validation in the manual Chutes login flow, potentially leading to credential substitution.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground without signup.
If you cannot update immediately, avoid using the manual Chutes OAuth login flow and be cautious about pasting OAuth callback data.
The consequences include potential credential substitution, where an attacker could gain unauthorized access to user accounts.
The CVSS score of this vulnerability is 5.1, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for openclaw.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.