Authentication Bypass Using an Alternate Path or Channel

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel in the Telegram callback query handling process. An attacker can modify session state by exploiting weaker callback-only...

CVE-2026-31048

creationtimestamp| type| source ---|---|--- 2026-04-10 17:00:04+00:00| seen| https://t.me/GithubRedTeam/79768 2026-04-10 21:00:05+00:00| published-proof-of-concept| Telegram/JqVwQ-JC9B9ph46qqgs1KPvHPPLX-sQPp9do9RGc2keWM...

CVE-2026-35661

OpenClaw before 2026.3.25 contains an authorization bypass vulnerability in Telegram callback query handling that allows attackers to mutate session state without satisfying normal DM pairing requirements. Remote attackers can exploit weaker callback-only authorization in direct messages to bypas...

CVE-2026-35661

CVE-2026-35661 affects OpenClaw prior to 2026.3.25. Affected component: Telegram callback query handling allows an authorization bypass that enables remote attackers to mutate session state without satisfying normal DM pairing. Attack requires no user interaction and network access (low complexit...

CVE-2026-35661 OpenClaw < 2026.3.25 - Telegram DM-Scoped Inline Button Callback Authorization Bypass

OpenClaw before 2026.3.25 contains an authorization bypass vulnerability in Telegram callback query handling that allows attackers to mutate session state without satisfying normal DM pairing requirements. Remote attackers can exploit weaker callback-only authorization in direct messages to bypas...

EUVD-2026-21468

OpenClaw before 2026.3.25 contains an authorization bypass vulnerability in Telegram callback query handling that allows attackers to mutate session state without satisfying normal DM pairing requirements. Remote attackers can exploit weaker callback-only authorization in direct messages to bypas...

CVE-2026-35661 OpenClaw < 2026.3.25 - Telegram DM-Scoped Inline Button Callback Authorization Bypass

OpenClaw before 2026.3.25 contains an authorization bypass vulnerability in Telegram callback query handling that allows attackers to mutate session state without satisfying normal DM pairing requirements. Remote attackers can exploit weaker callback-only authorization in direct messages to bypas...

CVE-2026-35661 OpenClaw < 2026.3.25 - Telegram DM-Scoped Inline Button Callback Authorization Bypass

OpenClaw before 2026.3.25 contains an authorization bypass vulnerability in Telegram callback query handling that allows attackers to mutate session state without satisfying normal DM pairing requirements. Remote attackers can exploit weaker callback-only authorization in direct messages to bypas...

GHSA-W5FQ-8965-C969

creationtimestamp| type| source ---|---|--- 2026-04-10 15:17:16+00:00| seen| Telegram/lguE38htKCDsrEIHzbRJLgqsKSDV6aHHtfYRxKZkwP2V8...

GHSA-2WGG-7R2P-CMQX

creationtimestamp| type| source ---|---|--- 2026-04-10 15:17:16+00:00| seen| Telegram/lguE38htKCDsrEIHzbRJLgqsKSDV6aHHtfYRxKZkwP2V8...

CVE-2026-5466

creationtimestamp| type| source ---|---|--- 2026-04-10 05:15:56+00:00| published-proof-of-concept| Telegram/1WdkdhXUJmGV7ePrqgJjIpgxUFBJfkFq-ncP6HWfcjVt70 2026-09-02 06:00:17+00:00| seen| https://t.me/RussianOSINT/7197 2026-09-03 00:00:44+00:00| seen| https://t.me/RussianOSINT/7197...

CVE-2026-6004

creationtimestamp| type| source ---|---|--- 2026-04-10 05:15:56+00:00| published-proof-of-concept| Telegram/1WdkdhXUJmGV7ePrqgJjIpgxUFBJfkFq-ncP6HWfcjVt70...

CVE-2026-5479

creationtimestamp| type| source ---|---|--- 2026-04-10 05:15:56+00:00| published-proof-of-concept| Telegram/1WdkdhXUJmGV7ePrqgJjIpgxUFBJfkFq-ncP6HWfcjVt70...

CVE-2026-35584

creationtimestamp| type| source ---|---|--- 2026-04-10 05:00:04+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/79698 2026-04-10 07:00:15+00:00| published-proof-of-concept| Telegram/4UpY9ng-1B7fl4pW8rF9tQFphK5boVLlHwZbJ8KZ6vXJanY 2026-04-10 09:00:05+00:00| published-proof-of-concept...

CVE-2026-29861

creationtimestamp| type| source ---|---|--- 2026-04-10 03:00:04+00:00| seen| https://t.me/GithubRedTeam/79673...

CVE-2026-5985

creationtimestamp| type| source ---|---|--- 2026-04-10 01:19:02+00:00| seen| Telegram/r2aLRB54IhOSR-P7tVQ1PquPIQ5c0jGeGUejuuUUcNPCN8...

EUVD-2026-21114

OpenClaw before 2026.3.25 contains a missing rate limiting vulnerability in Telegram webhook authentication that allows attackers to brute-force weak webhook secrets. The vulnerability enables repeated authentication guesses without throttling, permitting attackers to systematically guess webhook...

Duplicate Advisory: OpenClaw: Telegram Webhook Missing Guess Rate Limiting Enables Brute-Force Guessing of Weak Webhook Secret

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-vcx4-4qxg-mfp4. This link is maintained to preserve external references. Original Description OpenClaw before 2026.3.25 contains a missing rate limiting vulnerability in Telegram webhook authentication that allo...

GHSA-R4C2-GQ3J-7RPJ Duplicate Advisory: OpenClaw: Telegram Webhook Missing Guess Rate Limiting Enables Brute-Force Guessing of Weak Webhook Secret

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-vcx4-4qxg-mfp4. This link is maintained to preserve external references. Original Description OpenClaw before 2026.3.25 contains a missing rate limiting vulnerability in Telegram webhook authentication that allo...

PT-2026-31972

OpenClaw before 2026.3.25 contains an authorization bypass vulnerability in Telegram callback query handling that allows attackers to mutate session state without satisfying normal DM pairing requirements. Remote attackers can exploit weaker callback-only authorization in direct messages to bypas...