NPM: OpenClaw: Bootstrap token replay could widen pending pairing scopes

NPM: OpenClaw: Bootstrap token replay could widen pending pairing scopes vulnerability discovered by ? in WordPress Npm openclaw versions = 2026.5.10-beta.2...

EUVD-2026-37164

OpenClaw: Bootstrap token replay could widen pending pairing scopes...

Improper Privilege Management

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Improper Privilege Management via the bootstrap token process. An attacker can gain unauthorized access to broader pending pairing scopes by replaying a pending bootstrap token with an...

GHSA-H9H6-PWQV-J9HV Duplicate Advisory: Bootstrap token replay could widen pending pairing scopes

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9v8j-9c9g-w66c. This link is maintained to preserve external references. Original Description OpenClaw before 2026.5.12 contains a bootstrap token replay vulnerability allowing callers with pending token access ...

EUVD-2026-17022

OpenClaw before 2026.3.13 allows bootstrap setup codes to be replayed during device pairing verification in src/infra/device-bootstrap.ts. Attackers can verify a valid bootstrap code multiple times before approval to escalate pending pairing scopes, including privilege escalation to operator.admi...

Improper Privilege Management

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Improper Privilege Management. An attacker can gain unauthorized privileges by replaying a valid setup code before approval, allowing escalation of pending device pairing scopes...