CVE-2026-28475
MEDIUM SEVERITYCVSS Score & Metrics
Base Score
4.8 / 10
Vector String
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Vulnerability Description
OpenClaw versions prior to 2026.2.13 use non-constant-time string comparison for hook token validation, allowing attackers to infer tokens through timing measurements. Remote attackers with network access to the hooks endpoint can exploit timing side-channels across multiple requests to gradually recover the authentication token.
Vulnerability Details
Published Date
Last Modified
CWE ID
CWE-208
Source
NVD
Vendor
OpenClaw
Product
OpenClaw
Discussion (0)
Add Comment
No comments yet. Be the first!