VULNERABILITY INTELLIGENCE

CVE-2026-35646

CVSS score6.3 MEDIUM
EPSS probability0.24%
CISA KEVNot currently listed
Published2026-04-09
Last modified2026-06-17
CVSS vectorCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Description

OpenClaw before 2026.3.25 contains a pre-authentication rate-limit bypass vulnerability in webhook token validation that allows attackers to brute-force weak webhook secrets. The vulnerability exists because invalid webhook tokens are rejected without throttling repeated authentication attempts, enabling attackers to guess weak tokens through rapid successive requests.

Weakness classification

  • CWE-307: Improper Restriction of Excessive Authentication Attempts

Primary references