VULNERABILITY INTELLIGENCE

CVE-2026-35670

CVSS score5.9 MEDIUM
EPSS probability0.24%
CISA KEVNot currently listed
Published2026-04-10
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

Description

OpenClaw before 2026.3.22 contains a webhook reply delivery vulnerability that allows attackers to rebind chat replies to unintended users by exploiting mutable username matching instead of stable numeric user identifiers. Attackers can manipulate username changes to redirect webhook-triggered replies to different users, bypassing the intended recipient binding recorded in webhook events.

Weakness classification

  • disclosure@vulncheck.com: CWE-807

Primary references