PT-2026-30784 · Npm · Openclaw

Published 2026-03-27 · Updated 2026-03-27

OSV

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Summary

BlueBubbles Webhook Missing Guess Rate Limiting Enables Brute-Force Guessing of Weak Webhook Password

Affected Packages / Versions

• Package: openclaw
• Affected versions: <= 2026.3.24
• First patched version: 2026.3.25
• Latest published npm version at verification time: 2026.3.24

Details

BlueBubbles webhook auth previously rejected wrong passwords without throttling repeated guesses, allowing brute-force attempts against weak webhook passwords. Commit 5e08ce36d522a1c96df2bfe88e39303ae2643d92 adds repeated-guess throttling before auth failure responses.

Verified vulnerable on tag v2026.3.24 and fixed on main by commit 5e08ce36d522a1c96df2bfe88e39303ae2643d92.

Fix Commit(s)

• 5e08ce36d522a1c96df2bfe88e39303ae2643d92

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-521

CWE-307

Related Identifiers

GHSA-XQ8G-HGH6-87HV

Affected Products

Openclaw

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-35623 · Security Note
• https://osv.dev/vulnerability/GHSA-xq8g-hgh6-87hv · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/commit/5e08ce36d522a1c96df2bfe88e39303ae2643d92 · Note
• https://github.com/openclaw/openclaw/security/advisories/GHSA-xq8g-hgh6-87hv · Note
• https://vulncheck.com/advisories/openclaw-brute-force-attack-via-missing-webhook-password-rate-limiting · Note