OpenClaw versions before 2026.2.13 validate hook tokens using a non‑constant‑time string comparison. This flaw lets an attacker send repeated requests to the hooks endpoint and measure response times, deducing the token byte by byte. The attacker can therefore recover authentication tokens that grant access to protected hooks, leading to potential unauthorized execution or data exposure. The weakness is a classic timing side‑channel, identified as CWE‑208. No requirements for elevated privileges or local compromise are needed; simple network access to the hooks API is sufficient.

The vulnerability affects the OpenClaw application distributed as OpenClaw:OpenClaw. All releases prior to 2026.2.13 are impacted. Versions 2026.2.13 and later contain the fixed constant‑time comparison and are not vulnerable.

The CVSS base score of 6.3 indicates medium severity. The EPSS score is below 1 %, which suggests a low probability of exploitation at the time of this analysis, although the exploit is publicly known. The vulnerability is not present in the CISA KEV list, meaning there is no publicly confirmed exploitation yet. Attackers would need to transmit multiple requests over a reliable network connection, measure response latency with sufficient resolution, and aggregate data over several trials. This is feasible with modest effort, especially against exposed APIs. Consequently the risk is moderate, but the potential impact warrants prompt remediation.