CVE-2026-28477 | Teknoloji dünyasından en güncel haberleri ve güvenlikle ilgili gelişmeleri takip edin.

OpenClaw versions prior to 2026.2.14 contain an oauth state validation bypass vulnerability in the manual Chutes login flow that allows attackers to bypass CSRF…
Medium CVSS: 5.9

CVE-2026-28477

OpenClaw versions prior to 2026.2.14 contain an oauth state validation bypass vulnerability in the manual Chutes login flow that allows attackers to bypass CSRF protection. An attacker can convince a user to paste attacker-controlled OAuth callback data, enabling credential substitution and token persistence for unauthorized accounts.
Vendor
Openclaw
Product
Openclaw
CWE
CWE-352
Yayın Tarihi
2026-03-05 22:16:22
Güncelleme
2026-03-17 18:04:14
Source Identifier
disclosure@vulncheck.com
KEV Date Added
-

Kategoriler

CWE-352 Openclaw MEDIUM Openclaw 2026

Referanslar

https://github.com/openclaw/openclaw/commit/a99ad11a4107ba8eac58f54a3c1a8a0cf5686f47 https://github.com/openclaw/openclaw/security/advisories/GHSA-7rcp-mxpq-72pj https://www.vulncheck.com/advisories/openclaw-oauth-state-validation-bypass-in-manual-chutes-login-flow