CVE-2026-3690
High · 7.4CVSS
7.4
EPSS
0.6%
Published
Apr 11, 2026
CISA due date
—
The record
OpenClaw Canvas Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of OpenClaw. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the the authentication function for canvas endpoints. The issue results from improper implementation of authentication. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-29311.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-86485 In JetBrains YouTrack before 2026.2.18634 iP spoofing via HTTP headers allowed forged… CWE-291
- CVE-2026-4252 A vulnerability was identified in Tenda AC8 16.03.50.11. CWE-291
- GHSA-vvjh-f6p9-5vcf OpenClaw Canvas Authentication Bypass Vulnerability CWE-291
- CVE-2025-66602 A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. CWE-291
- CVE-2025-59101 Instead of typical session tokens or cookies, it is verified on a per-request basis if… CWE-291