Executive Summary

This vulnerability exists in OpenClaw versions before 2026.4.2, where the PKCE verifier is reused as the OAuth state parameter in the Gemini OAuth flow.

Because the PKCE verifier is exposed through the redirect URL, attackers who capture this URL can obtain both the authorization code and the PKCE verifier.

This defeats the protection normally provided by PKCE, allowing attackers to redeem tokens that should be protected.

Useful 0 Not Useful 0

Impact Analysis

An attacker who captures the redirect URL can obtain sensitive OAuth credentials, specifically the authorization code and PKCE verifier.

This enables the attacker to redeem tokens that grant access to protected resources, potentially leading to unauthorized access.

Useful 0 Not Useful 0