CVE-2026-35664

CVE-2026-35664 affects OpenClaw prior to version 2026.3.25. The vulnerability is an authentication bypass in the raw card send surface, enabling unpaired recipients to mint legacy callback payloads. Attackers can issue raw card commands to bypass DM pairing restrictions and access callback handli...

GHSA-77W2-CRQV-CMV3 OpenClaw: Feishu Raw Card Send Surface Can Mint Legacy Card Callbacks That Bypass DM Pairing

Summary Feishu Raw card Send Surface Can Mint Legacy Card Callbacks That Bypass DM Pairing Affected Packages / Versions - Package: openclaw - Affected versions: = 2026.3.24 - First patched version: 2026.3.25 - Latest published npm version at verification time: 2026.3.24 Details Feishu raw card...