OpenClaw versions prior to 2026.2.25 have an authentication hardening gap in browser‑origin WebSocket clients. The flaw allows attackers to bypass origin checks and authentication throttling, enabling password brute‑force attacks against the gateway and the creation of an authenticated operator session. This yields the attacker the ability to invoke privileged control‑plane methods. The weakness corresponds to CWE‑307 – Improper Restriction of Credentials Exposure.

The vulnerability affects all OpenClaw deployments before version 2026.2.25. It applies to the OpenClaw gateway product for environments that enable browser‑origin WebSocket connections on the loopback interface.

The CVSS score is 7.5, indicating a high severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires a victim to open a malicious webpage that initiates a WebSocket connection to the local gateway, using the browser's origin header to bypass checks. While the exploit requires user interaction, the potential impact of gaining privileged control-plane access is significant, warranting a high risk assessment.