CVE-2026-28477 json
OpenClaw < 2026.2.14 - OAuth State Validation Bypass in Manual Chutes Login Flow
published 2026-02-18 8 mo ago modified 2026-06-17 4 mo ago also GHSA-7rcp-mxpq-72pj , EUVD-2026-9923
- cvss
- 7.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 4%
- public exploits
- 0
- none known
Summary
OpenClaw versions prior to 2026.2.14 contain an oauth state validation bypass vulnerability in the manual Chutes login flow that allows attackers to bypass CSRF protection. An attacker can convince a user to paste attacker-controlled OAuth callback data, enabling credential substitution and token persistence for unauthorized accounts.
Patch / fix
- npm openclaw 2026.2.14
- OpenClaw OpenClaw 2026.2.14
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 8 mo ago
Exploit prediction
0.16% chance of exploitation in the next 30 days, higher than 4% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.9 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N |
| CNA | 3.1 | 7.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N |
| CNA | 4.0 | 5.9 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| GitHub | 3.1 | 5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | openclaw | <2026.2.14 |
2026.2.14 |
Affected products
- OpenClaw OpenClaw
Classification
- Weakness
-
- CWE-352 Cross-Site Request Forgery
References
-
github.com
/openclaw/openclaw/commit/a99ad11a4107ba8eac58f54a3c1a8a0cf5686f47
patch, web
-
github.com
/openclaw/openclaw/security/advisories/GHSA-7rcp-mxpq-72pj
vendor-advisory, web
-
vulncheck.com
/advisories/openclaw-oauth-state-validation-bypass-in-manual-chutes-login-flow
third-party-advisory, web
-
nvd.nist.gov
/vuln/detail/CVE-2026-28477
advisory
-
github.com
/openclaw/openclaw
package
-
github.com
/openclaw/openclaw/releases/tag/v2026.2.14
web
Sources
- CVE List CVE-2026-28477
- GitHub Advisory GHSA-7rcp-mxpq-72pj
- NVD CVE-2026-28477
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.