The vulnerability resides in the authentication logic for Canvas endpoints in OpenClaw. Because authentication is not enforced, attackers can gain unrestricted access to the system without valid credentials. This flaw permits an attacker to execute any operation that a legitimate authenticated user would be able to perform, potentially exposing sensitive data or modifying system state. The weakness corresponds to improper authentication (CWE-291).

OpenClaw product, all installed versions of OpenClaw are potentially affected. The flaw is reported to exist in the canvas authentication function, but no specific version range is identified in the advisory. Systems running OpenClaw should therefore review whether they are running the current version or assess for any unpatched code paths.

The CVSS score of 7.4 indicates high severity. EPSS data is not available, and the vulnerability is not listed in the KEV catalog. The attack vector is inferred to be remote, with an attacker able to trigger the bypass through web requests to Canvas endpoints. No public exploit code is cited, but the ability to authenticate without credentials makes the vulnerability readily exploitable by anyone with network access to the application.