VULNERABILITY INTELLIGENCE

CVE-2026-35664

CVSS score5.3 MEDIUM
EPSS probability0.28%
CISA KEVNot currently listed
Published2026-04-10
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Description

OpenClaw before 2026.3.25 contains an authentication bypass vulnerability in raw card send surface that allows unpaired recipients to mint legacy callback payloads. Attackers can send raw card commands to bypass DM pairing restrictions and reach callback handling without proper authorization.

Weakness classification

  • disclosure@vulncheck.com: CWE-288

Primary references