Cloudanix VulnDB

GHSA-vmvw-pwwf-cc2w

Low · 3.7

Duplicate Advisory: OpenClaw has cross-account DM pairing authorization bypass via unscoped pairing store access

CVSS

3.7

EPSS

—

Published

Mar 21, 2026

CISA due date

—

The record

## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-vjp8-wprm-2jw9. This link is maintained to preserve external references. ## Original Description OpenClaw versions prior to 2026.2.26 contains an authorization bypass vulnerability in the pairing-store access control for direct message pairing policy that allows attackers to reuse pairing approvals across multiple accounts. An attacker approved as a sender in one account can be automatically accepted in another account in multi-account deployments without explicit approval, bypassing authorization boundaries.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities