OpenClaw plugins that handle device pairing contain an authorization bypass flaw that allows any chat sender with command privileges, even if not the device owner, to issue device‑pairing bootstrap codes. These codes enable the enrollment of new devices with operator or node level permissions, granting persistent credentials until the codes are manually revoked. The vulnerability is a classic example of improper authorization (CWE‑862) and can compromise the entire device network by allowing an attacker to control or alter paired devices. Its impact is limited to users with chat command access, but it can affect all devices that trust the bootstrap codes.

Vendors: OpenClaw. All OpenClaw releases before version 2026.5.4 are affected. No specific sub‑version range is listed; therefore any installation of OpenClaw prior to 2026.5.4 is vulnerable.

The CVSS score of 8.7 indicates a high severity vulnerability. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. The likely attack vector is remote interaction via chat command, though an attacker could also abuse a local or compromised chat account. The absence of a known exploit does not diminish the inherent risk, as the flaw can be exercised directly by sending the proper command. The straightforward exploitation path warrants immediate remediation.