The vulnerability is a missing rate limiting mechanism on the Telegram webhook authentication in OpenClaw versions prior to 2026.3.25. This flaw allows an adversary to send repeated authentication attempts without any throttling, effectively enabling a brute‑force attack against the webhook secret. Discovery of the secret permits the attacker to post arbitrary content or commands through the webhook, potentially triggering unintended actions. The weakness is identified as CWE‑307.

The issue impacts any deployment of the OpenClaw application running a version earlier than 2026.3.25. This includes all Node.js‑based builds that expose the Telegram webhook endpoint. No specific operating system or hardware constraints were noted in the advisory.

The CVSS score of 6.3 indicates a medium severity. With no EPSS score reported, the exploitation probability remains uncertain. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation yet. Attackers would need network access to the Telegram webhook endpoint and could manually iterate through potential secrets or employ automated tools. The absence of rate limiting removes practical brute‑force resistance, making exploitation easier for a determined attacker.