OpenClaw versions before 2026.3.28 do not properly close active WebSocket sessions when a device is removed or an authentication token is revoked. As a result, an attacker who has had credentials revoked can still maintain a live session until the client side is forced to reconnect. This allows the attacker ongoing unauthorized access, undermining the intended revocation and potentially exposing data or enabling further malicious activity. The weakness corresponds to insufficient session termination, classified as CWE-613.

This flaw affects the OpenClaw platform distributed under the OpenClaw brand, built on Node.js. All releases prior to 2026.3.28 are vulnerable. The issue is present in the core server component that handles WebSocket connections and token validation. Administrators of deployments using any of these affected releases should verify the software version and update accordingly.

The CVSS score of 8.6 indicates a high severity, and the absence of an EPSS score leaves the global exploitation probability unknown, but the vulnerability permits continued unauthorized access even after revocation, which is dangerous. The lack of listing in the CISA KEV catalog suggests no known public exploitation yet, yet the attack vector is likely remote via the WebSocket channel. Administrators should treat this as a critical issue and apply the upgrade immediately, as it avoids prolonged privilege persistence.