CVE-2026-43572

MEDIUM

OpenClaw 2026.4.10 < 2026.4.14 - Missing Sender Authorization in Microsoft Teams SSO Invoke Handler

Title source: cna
STIX 2.1

Description

OpenClaw versions 2026.4.10 before 2026.4.14 contain a missing authorization vulnerability in the Microsoft Teams SSO invoke handler that fails to apply sender allowlist checks. Attackers can bypass sender authorization by sending SSO invoke requests that are processed without proper validation, allowing unauthorized access to Teams SSO signin functionality.

References (3)

Core 3
Core References
Vendor Advisory vendor-advisory
GitHub Security Advisory (GHSA-gc9r-867r-j85f)
https://github.com/openclaw/openclaw/security/advisories/GHSA-gc9r-867r-j85f
Third Party Advisory third-party-advisory
VulnCheck Advisory: OpenClaw 2026.4.10 < 2026.4.14 - Missing Sender Authorization in Microsoft Teams SSO Invoke Handler
https://www.vulncheck.com/advisories/openclaw-missing-sender-authorization-in-microsoft-teams-sso-invoke-handler

Scores

CVSS v3 5.3
EPSS 0.0003
EPSS Percentile 8.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-862
Status published
Products (3)
npm/openclaw 2026.4.10 - 2026.4.14npm
OpenClaw/OpenClaw 2026.4.10 - 2026.4.14
OpenClaw/OpenClaw 2026.4.14
Published May 05, 2026
Tracked Since May 05, 2026