PT-2026-32295 · Npm · Openclaw

Published 2026-04-03 · Updated 2026-04-03

OSV

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Summary

Fake DeviceToken Bypasses Shared Auth Rate Limiting

Current Maintainer Triage

• Status: narrow
• Normalized severity: low
• Assessment: Real in shipped mixed WS auth flow, but practical risk is mostly weak shared-password deployments since strong shared tokens remain non-bruteforceable.

Affected Packages / Versions

• Package: openclaw (npm)
• Latest published npm version: 2026.3.31
• Vulnerable version range: <=2026.3.28
• Patched versions: >= 2026.3.31
• First stable tag containing the fix: v2026.3.31

Fix Commit(s)

• af0c0862f22ca4492406a3103d05e3628f94cbe9 — 2026-03-31T09:08:57+09:00

Release Process Note

• The fix is already present in released version 2026.3.31.

OpenClaw thanks @kexinoh of Tencent zhuque Lab (https://github.com/Tencent/AI-Infra-Guard) for reporting.

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-799

CWE-307

Related Identifiers

GHSA-6P8R-6M93-557F

Affected Products

Openclaw

References · 6

• https://osv.dev/vulnerability/GHSA-6p8r-6m93-557f · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/security/advisories/GHSA-6p8r-6m93-557f · Note
• https://github.com/openclaw/openclaw/commit/af0c0862f22ca4492406a3103d05e3628f94cbe9 · Note
• https://github.com/openclaw/openclaw/releases/tag/v2026.3.31 · Note
• https://vulncheck.com/advisories/openclaw-authentication-rate-limiting-bypass-via-fake-devicetoken · Note