OpenClaw versions prior to 2026.23 incorrectly compute replay keys by incorporating the entire query string of signed requests instead of using only the base URL. This flaw, which falls under authentication bypass weaknesses, allows an attacker to modify unsigned query parameters and create a new replay key that the system accepts. The consequence is a bypass of the replay protection mechanism, giving an adversary the ability to forge or replay authenticated requests, thereby compromising request integrity and potentially enabling unauthorized actions.

The vulnerability affects the OpenClaw application distributed as a Node.js package. All installations running any release before 2026.3.23 are susceptible, regardless of operating environment, as the issue resides within the OpenClaw code base referenced by its CPE taxonomy.

The CVSS score of 8.3 marks this flaw as high severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is remote, requiring only the ability to send HTTP requests to the target service. An attacker can generate a valid replay key by altering query strings in signed requests, without knowledge of secret keys, and replay or modify requests with assurance of authentication acceptance.