Executive Summary

OpenClaw versions prior to 2026.2.25 have a security weakness in their browser-origin WebSocket clients. This weakness allows attackers to bypass origin checks and authentication throttling when the software is deployed on loopback interfaces.

An attacker can exploit this by tricking a user into opening a malicious webpage, which then performs password brute-force attacks against the OpenClaw gateway. If successful, the attacker can establish an authenticated operator session and gain the ability to invoke control-plane methods.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to bypass authentication protections and gain unauthorized access to the OpenClaw gateway.

Once authenticated, the attacker can invoke control-plane methods, potentially allowing them to control or manipulate the system in unauthorized ways.

This could lead to unauthorized operations, data compromise, or disruption of services managed by the OpenClaw gateway.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

I don't know

Useful 0 Not Useful 0

Mitigation Strategies

I don't know

Useful 0 Not Useful 0