The flaw resides in the OAuth authorization flow of the OpenClaw client, where a PKCE verifier is inadvertently exposed in the authorization URL query string. This exposure permits a remote actor to read locally stored credentials when the target initiates an authentication request. The consequence is that an attacker obtains credentials that could be used to impersonate the user or access protected resources, effectively escalating privileges on the susceptible system.

OpenClaw’s client application is affected. Any installation that implements the OAuth flow is vulnerable; the advisory does not specify a version range, so all releases prior to the fix are at risk.

The CVSS score of 5.3 indicates moderate severity. Exploitation requires user interaction, as the target must start an OAuth authorization flow. An attacker can observe or inject the request to capture the verifier in the query string, so the technical barrier is modest. EPSS data is not available and the vulnerability is not currently listed in CISA’s KEV catalog, suggesting limited exploitation reports. Nonetheless, the exposed credentials can lead to significant compromise if abused.