OpenClaw versions prior to 2026.3.25 contain a pre-authentication rate‑limit bypass in the webhook token validation logic. The flaw causes invalid tokens to be rejected without imposing a throttle on repeated authentication attempts, allowing an attacker to brute‑force weak webhook secrets quickly. Successful guessing of a secret grants the attacker unauthorized access to the webhook service, which can lead to malicious data injection or execution of unintended actions, thereby compromising the integrity and confidentiality of the system."

The vulnerability affects OpenClaw software distributed under the OpenClaw product line, specifically any installation running a version earlier than 2026.3.25. The software operates in a Node.js environment, and the weakness resides in the web layer that processes incoming webhook requests.

The CVSS v3 base score of 6.3 classifies this issue as medium severity. No EPSS score is available, and the vulnerability is not listed on the CISA KEV catalog. The most likely attack vector is remote over the network, requiring no prior authentication. An attacker can launch rapid successive requests directly to the webhook endpoint to enumerate or guess weak secrets, achieving the effect if the secret is not sufficiently complex. There are no notable environmental constraints beyond having network exposure to the webhook interface.