CVE-2026-28480

MEDIUM

OpenClaw <2026.2.14 - Auth Bypass

Title source: llm

Description

OpenClaw versions prior to 2026.2.14 contain an authorization bypass vulnerability where Telegram allowlist matching accepts mutable usernames instead of immutable numeric sender IDs. Attackers can spoof identity by obtaining recycled usernames to bypass allowlist restrictions and interact with bots as unauthorized senders.

References (4)

[Patch] https://github.com/openclaw/openclaw/commit/9e147f00b48e63e7be6964e0e2a97f2980854128

View Patch ZIP pw:eip

[Patch] https://github.com/openclaw/openclaw/commit/e3b432e481a96b8fd41b91273818e514074e05c3

[Vendor Advisory] https://github.com/openclaw/openclaw/security/advisories/GHSA-mj5r-hh7j-4gxf

[Third Party Advisory] https://www.vulncheck.com/advisories/openclaw-identity-spoofing-via-mutable-username-in-telegram-allowlist-authorization

Scores

CVSS v3 6.5

EPSS 0.0003

EPSS Percentile 7.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Classification

CWE

CWE-290

Status draft

Affected Products (2)

npm/openclaw < 2026.2.14npm

npm/clawdbot npm

Timeline

Published Mar 05, 2026

Tracked Since Mar 06, 2026