The vulnerability allows an attacker with access to an authenticated node‑role websocket client to set the client.id parameter to "control‑ui", bypassing the Control UI pairing mechanism. This bypass removes the required device identity verification and permits the attacker to execute node event flows without proper authorization. As a result, the attacker gains unauthorized control over the target node, potentially leading to malicious actions or data exposure.

OpenClaw (OpenClaw) versions prior to 2026.2.25 are affected.

The CVSS score is 6, indicating a medium severity. No EPSS value is provided and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog, suggesting low to moderate exploitation likelihood. The attack vector involves a network‑based websocket connection from an authenticated node role client; an attacker must first obtain valid credentials or use another vulnerability to gain node‑role access before exploiting the bypass. Once the bypass is achieved, the attacker can execute arbitrary node‑level event flows.