OpenClaw versions prior to 2026.3.31 allow an attacker to bypass authentication rate limiting by supplying forged device tokens during the mixed WebSocket authentication flow. The flaw exploits the handling of device tokens (CWE‑799) so that the rate‑limiting checks are ineffective, enabling brute‑force attempts against weak shared passwords that would otherwise be throttled. The consequence is the ability to systematically test credentials without triggering account lockout or alerting mechanisms, potentially leading to unauthorized account access.

The vulnerability affects the OpenClaw application distributed by OpenClaw:OpenClaw for all supported Node.js environments. Any deployment of OpenClaw using a version older than 2026.3.31 is susceptible; the patch is incorporated in 2026.3.31 and later releases.

The CVSS v3.1 score of 6.3 indicates a moderate threat, and the EPSS score of less than 1% suggests that exploitation is unlikely at the time of assessment. The vulnerability is not listed in the CISA KEV catalog. Successful exploitation requires network access to the OpenClaw service and the ability to send crafted WebSocket authentication messages, which is feasible for remote attackers with visibility into the WebSocket channel.