Description
OpenClaw versions prior to 2026.2.26 contain an authorization bypass vulnerability in the pairing-store access control for direct message pairing policy that allows attackers to reuse pairing approvals across multiple accounts. An attacker approved as a sender in one account can be automatically accepted in another account in multi-account deployments without explicit approval, bypassing authorization boundaries.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
OpenClaw OpenClaw
Default version status: unaffected
0 to < 2026.2.26affected2026.2.26unaffected
pkg:npm/openclawReferences
- https://github.com/openclaw/openclaw/security/advisories/GHSA-vjp8-wprm-2jw9 ↗
- https://github.com/openclaw/openclaw/commit/a0c5e28f3bf0cc0cd9311f9e9ec2ca0352550dcf ↗
- https://github.com/openclaw/openclaw/commit/bce643a0bd145d3e9cb55400af33bd1b85baeb02 ↗
- https://www.vulncheck.com/advisories/openclaw-cross-account-authorization-bypass-in-dm-pairing-store ↗