Skip to content
CVE PROGRAM SOURCE RECORD7.6 High

CVE-2026-100540

OpenClaw Feishu before 2026.8.1 Authentication Bypass via Disabled Account

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

OpenClaw Feishu before 2026.8.1 fails to validate whether a configured default account is disabled before selecting it for model tool operations. Attackers can exploit multi-account setups where a disabled default account retains credentials to read or modify Feishu resources through a revoked identity.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

openclaw feishu

Default version status: unaffected

  • 0 to < 2026.8.1affected
  • 2026.8.1unaffected
pkg:npm/%40openclaw/feishu

References