1 matches found
OpenClaw's typed sender-key matching for toolsBySender prevents identity-collision policy bypass
Summary channels..groups..toolsBySender could match a privileged sender policy using a colliding mutable identity value for example senderName or senderUsername when deployments used untyped keys. The fix introduces explicit typed sender keys id:, e164:, username:, name:, keeps legacy untyped key...
6.5CVSS5.9AI score0.0019EPSS
SaveExploits0References5Affected Software1
20