Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.6
Synology Chat Webhook Token Guessing Vulnerability in OpenClaw
published 6 months ago
Summary
An attacker can guess a weak Synology Chat webhook token by repeatedly sending invalid requests. This affects OpenClaw before a specific version. Update to the latest version to prevent token guessing attacks.
What to do
- Update steipete openclaw to version 2026.3.28.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| npm | steipete | openclaw |
< 2026.3.28 Fix: upgrade to 2026.3.28
|
Original advisory text
Duplicate Advisory: OpenClaw: Synology Chat Webhook Pre-Auth Rate-Limit Bypass Enables Brute-Force Guessing of Webhook Token
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-mf5g-6r6f-ghhm. This link is maintained to preserve external references.
### Original Description
OpenClaw before 2026.3.25 contains a pre-authentication rate-limit bypass vulnerability in webhook token validation that allows attackers to brute-force weak webhook secrets. The vulnerability exists because invalid webhook tokens are rejected without throttling repeated authentication attempts, enabling attackers to guess weak tokens through rapid successive requests.
This advisory has been withdrawn because it is a duplicate of GHSA-mf5g-6r6f-ghhm. This link is maintained to preserve external references.
### Original Description
OpenClaw before 2026.3.25 contains a pre-authentication rate-limit bypass vulnerability in webhook token validation that allows attackers to brute-force weak webhook secrets. The vulnerability exists because invalid webhook tokens are rejected without throttling repeated authentication attempts, enabling attackers to guess weak tokens through rapid successive requests.
References
- https://github.com/openclaw/openclaw/security/advisories/GHSA-mf5g-6r6f-ghhm URL
- https://nvd.nist.gov/vuln/detail/CVE-2026-35646 Vendor Advisory
- https://github.com/openclaw/openclaw/commit/0b4d07337467f4d40a0cc1ced83d45ceaec0... URL
- https://www.vulncheck.com/advisories/openclaw-pre-authentication-rate-limit-bypa... URL
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-307Improper Restriction of Excessive Authentication Attempts
Timeline
Published10 Apr 2026
Updated10 Apr 2026
First seen10 Apr 2026
Sources
GHSA-59xc-5v89-r7pr · OSV
Track software like this
Free during beta