CVE-2026-108757

The Nexting pinclaw OpenClaw channel plugin, in versions through 0.3.0 , contains a missing authentication vulnerability in src/core/http-router.ts. The flaw occurs because the software fails to perform an authToken check on the POST /pinclaw/send endpoint. Because the service binds to all interf...

EUVD-2026-96922

Nexting pinclaw OpenClaw channel plugin through 0.3.0 contains a missing authentication vulnerability in src/core/http-router.ts that skips the authToken check on POST /pinclaw/send. Unauthenticated attackers reaching port 18790, which binds all interfaces by default, can inject blind prompts int...