← Database

CVE-2026-28477

HIGH CVSS: 7.1 Published: 2026-03-05 Modified: 2026-06-17

Description

OpenClaw versions prior to 2026.2.14 contain an oauth state validation bypass vulnerability in the manual Chutes login flow that allows attackers to bypass CSRF protection. An attacker can convince a user to paste attacker-controlled OAuth callback data, enabling credential substitution and token persistence for unauthorized accounts.

Affected Platforms

Openclaw Openclaw

Weakness Type

CWE-352

References