Insufficiently Protected Credentials

Overview @openclaw/msteams is an OpenClaw Microsoft Teams channel plugin Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the MS Teams outbound requests. An attacker can obtain sensitive authentication tokens by accessing configured input paths that...

CVE-2026-62224 OpenClaw MS Teams < 2026.5.12 Authorization Bypass

OpenClaw MS Teams before 2026.5.12 contain an authorization bypass vulnerability where the allowFrom feature binds to mutable display names. Attackers with lower-trust access can perform actions requiring stronger authorization by exploiting the mutable display name binding in the affected featur...