VULNERABILITY INTELLIGENCE

CVE-2026-41333

CVSS score3.7 LOW
EPSS probability0.39%
CISA KEVNot currently listed
Published2026-04-23
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Description

OpenClaw before 2026.3.31 contains an authentication rate limiting bypass vulnerability that allows attackers to circumvent shared authentication protections using fake device tokens. Attackers can exploit the mixed WebSocket authentication flow to bypass rate limiting controls and conduct brute force attacks against weak shared passwords.

Weakness classification

  • disclosure@vulncheck.com: CWE-799

Primary references