CVE-2026-41333
Low · 3.7CVSS
3.7
EPSS
0.4%
Published
Apr 23, 2026
CISA due date
—
The record
OpenClaw before 2026.3.31 contains an authentication rate limiting bypass vulnerability that allows attackers to circumvent shared authentication protections using fake device tokens. Attackers can exploit the mixed WebSocket authentication flow to bypass rate limiting controls and conduct brute force attacks against weak shared passwords.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | openclaw | 0 | 2026.3.31 |
Related vulnerabilities
- GHSA-6p8r-6m93-557f OpenClaw: Fake DeviceToken Bypasses Shared Auth Rate Limiting Same vulnerability
- GHSA-4hpg-mp64-x7xq OpenClaw: Internal/webchat command auth could inherit ownerAllowFrom wildcard state Also affects openclaw
- GHSA-8mg9-j9cf-54cj OpenClaw: Empty-scope device re-pairing could confuse caller scope containment Also affects openclaw
- GHSA-rx78-29qr-5hq8 OpenClaw: Workspace-derived service PATH could influence trash command selection Also affects openclaw
- GHSA-wc84-j36w-pw4x OpenClaw: Workspace .env STATE_DIRECTORY could influence bundled runtime dependency roots Also affects openclaw
- GHSA-cw4q-gqg5-g38h OpenClaw: Discord allowFrom could bind to mutable display names Also affects openclaw
- GHSA-mpc8-jxjh-qpgh OpenClaw: Focus command could miss controlScope enforcement Also affects openclaw
- GHSA-24vr-rprv-67rf OpenClaw: Workspace .env npm_execpath could influence bundled runtime dependency install Also affects openclaw