A timing side‑channel exists in OpenClaw’s hook token validation because string comparison is performed in a non‑constant‑time manner. An attacker can use the time taken to compare string fragments across many requests to deduce the exact value of a hook token. The disclosure of this token effectively compromises the authentication mechanism for the hooks endpoint and can allow further unauthorized use of OpenClaw’s API endpoints that rely on the same token.

The vulnerability affects the OpenClaw product, specifically all releases older than version 2026.2.12. Users running vulnerabilities should check whether they are on a pre‑2026.2.12 build and plan an upgrade accordingly.

The CVSS score of 8.2 indicates a high‑severity flaw, yet the EPSS score is below 1% and the flaw is not yet listed in CISA’s KEV catalog, suggesting a low probability of widespread exploitation at the moment. The likely attack path involves a remote attacker with network access to the hooks endpoint, sending multiple crafted requests to measure response times and gradually reconstruct the token. While the attack requires repeated measurements, the information gained can be highly valuable to attackers.