NPM: OpenClaw: Pairing-scoped device session could restore revoked node token authority

NPM: OpenClaw: Pairing-scoped device session could restore revoked node token authority vulnerability discovered by ? in WordPress Npm openclaw versions 2026.5.26...

GHSA-WRMQ-9FC4-GWWJ Duplicate Advisory: Pairing-scoped device session could restore revoked node token authority

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-q99w-vh6v-q3v7. This link is maintained to preserve external references. Original Description OpenClaw before 2026.5.26 contains an authorization bypass vulnerability where a surviving pairing-scoped device...

PT-2026-49760

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.5.26 Description An authorization bypass exists where a surviving pairing-scoped device session can re-establish node token authority after the token has been revoked. This allows a previously paired device to...