In OpenClaw versions before 2026.3.12 the rate limiting mechanism for webhook endpoints is applied only after a successful authentication. Because the check comes too late, an attacker can send many requests that fail authentication, never triggering a 429 response. This allows the attacker to repeatedly guess the secret key until the correct one is discovered and then use that valid credential to send forged Zalo webhook traffic. The weakness stems from insecure access control (CWE‑307) and results in unauthorized use of the webhook API.

The vulnerability affects the OpenClaw application; all installations running OpenClaw version 2026.3.11 or earlier are impacted. There is no other product or vendor listed as affected in the CNA data.

The CVSS base score of 6.3 describes a medium severity flaw with potential for unauthorized access to the webhook interface. The EPSS score is not provided, and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited known exploitation to date. However, the attack vector is likely remote, as the webhook endpoint is accessible over the Internet. An attacker can launch the brute‑force attack from any location that can reach the webhook URL, and by bypassing the rate limiter the attack can be carried out with high frequency until the secret key is discovered. Overall the risk is moderate to high for systems that rely on the webhook for critical integrations and do not have additional rate limiting or firewall controls in place.