OpenClaw software prior to version 2026.3.25 lacks rate limiting on webhook authentication. This omission permits attackers to repeatedly submit incorrect passwords to the webhook endpoint and systematically brute‑force a weak webhook password. Successful brute force results in unauthorized access to the webhook, potentially exposing sensitive data or allowing further compromise of the system. The weakness is an example of CWE‑307, insufficient credential lockout or accounting.

The vulnerability affects the OpenClaw product from OpenClaw, Inc. Any deployment of OpenClaw that uses the webhook authentication mechanism and runs a version older than 2026.3.25 is susceptible. No additional sub‑version details are provided in the advisory.

The CVSS score of 6.3 indicates moderate severity, and the lack of an EPSS score or KEV listing suggests that widespread exploitation has not been confirmed yet, though the missing rate limiting makes the attack trivial for a remote attacker who can reach the webhook endpoint. The attack requires only the ability to send HTTP requests to the webhook URL; no local system compromise or privileged credentials are needed. Consequently, the risk is moderate, but the exploitability is high once the endpoint is reachable.