PT-2026-23552 · Openclaw · Openclaw

Aether Ai · Published 2026-02-18 · Updated 2026-03-07 · CVE-2026-28477

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.14

Description The manual Chutes OAuth login flow in OpenClaw is susceptible to a bypass of OAuth CSRF state validation. This allows an attacker to bypass CSRF protection by convincing a user to paste attacker-controlled OAuth callback data, potentially leading to credential substitution and the persistence of tokens for unauthorized accounts. The automatic local callback flow is not affected.

Recommendations Update to version 2026.2.14 or later.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-28477

GHSA-7RCP-MXPQ-72PJ

Affected Products

Openclaw

References · 10

• https://github.com/openclaw/openclaw/commit/a99ad11a4107ba8eac58f54a3c1a8a0cf5686f47 · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-7rcp-mxpq-72pj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28477 · Security Note
• https://osv.dev/vulnerability/CVE-2026-28477 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7rcp-mxpq-72pj · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/releases/tag/v2026.2.14 · Note
• https://twitter.com/CVEnew/status/2030385170780442800 · Twitter Post
• https://t.me/CVEtracker/46496 · Telegram Post
• https://vulncheck.com/advisories/openclaw-oauth-state-validation-bypass-in-manual-chutes-login-flow · Note