CVE-2026-32025 | BDVDB-2026-321305 Detail

Description#

OpenClaw versions prior to 2026.2.25 contain an authentication hardening gap in browser-origin WebSocket clients that allows attackers to bypass origin checks and auth throttling on loopback deployments. An attacker can trick a user into opening a malicious webpage and perform password brute-force attacks against the gateway to establish an authenticated operator session and invoke control-plane methods.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-03-19Record published in the CVE List.
2. Version 22026-06-23Most recent update recorded in the CVE List.