CVE-2026-28477

MEDIUM SEVERITY

CVSS Score & Metrics

Base Score

5.9 / 10

Vector String

                                        CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N                                    

Vulnerability Description

OpenClaw versions prior to 2026.2.14 contain an oauth state validation bypass vulnerability in the manual Chutes login flow that allows attackers to bypass CSRF protection. An attacker can convince a user to paste attacker-controlled OAuth callback data, enabling credential substitution and token persistence for unauthorized accounts.

Vulnerability Details

Published Date

March 05, 2026

Last Modified

March 09, 2026

CWE ID

CWE-352

Source

NVD

Vendor

OpenClaw

Product

OpenClaw

External References

https://github.com/openclaw/openclaw/commit/a99ad11a4107ba8eac58f54a3c1a8a0cf5686f47
https://github.com/openclaw/openclaw/security/advisories/GHSA-7rcp-mxpq-72pj
https://www.vulncheck.com/advisories/openclaw-oauth-state-validation-bypass-in-manual-chutes-login-flow

CVE-2026-28477

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment