The flaw arises in the MethodRouter.Handle routine of GoClaw’s WebSocket allows an attacker to send crafted RPC messages that bypass intended access controls. The result is the ability to invoke privileged operations without proper authentication, effectively granting unauthorized access to protected functionality. The weakness is categorized as CWE‑285 (Incorrect Authorization) and CWE‑863 (Authorization Bypass Through User‑Controlled Data).

The vulnerability is present in nextlevelbuilder GoClaw releases up to and including 3.13.0‑beta.2, as well as all earlier versions. Any deployment that exposes the WebSocket RPC endpoint to external or untrusted networks is susceptible; the flaw can be triggered remotely over the standard WebSocket protocol.

The CVSS base score of 5.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low current likelihood of exploitation. The flaw is not listed in the CISA KEV catalog. Because the attack vector is remote, exposed instances face a moderate risk if attackers succeed. Deployments should monitor for anomalous RPC activity and consider limiting exposure until a patch is available.