OpenClaw versions before 2026.2.14 suffer a webhook routing flaw in the Google Chat monitor component. The flaw is a CWE-639 authority abuse weakness, allowing requests sent to a shared HTTP path to be processed under an account context that does not match the origin, effectively bypassing account‑specific allowlists and session policies. This misrouting can lead to unauthorized handling of webhook events as if they were intended for a different account, compromising confidentiality and integrity of account data.

The vulnerability affects OpenClaw’s webhook services running any version prior to 2026.2.14. The affected product is OpenClaw, and all instances that expose the Google Chat monitor webhook on shared paths are susceptible. No other vendor or product is affected.

The CVSS base score of 8.2 indicates high severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Attackers could exploit the first‑match request verification behavior by sending crafted webhook traffic to a shared path, thereby causing the system to treat them as belonging to another account. The required conditions are minimal: an attacker must be able to generate a Google Chat webhook event that targets the vulnerable path, which can be achieved by a compromised client or by abuse of legitimate webhook endpoints.