The vulnerability is an authentication boundary flaw in OpenClaw prior to version 2026.3.31. During the Telegram legacy allowFrom migration the system incorrectly propagates the default-account trust to all named accounts, allowing a malicious actor to obtain privileged access to those accounts without proper authentication. This flaw falls under CWE‑372, which involves an incorrect control of trust. The impact is that a wrong configuration can let an attacker bypass authentication controls and gain unauthorized access to any named account on the platform.

All OpenClaw deployments running any version older than 2026.3.31, regardless of edition.

The CVSS score of 6.3 indicates moderate severity, while the EPSS score of <1% suggests that exploitation is currently unlikely. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to involve triggering or manipulating the legacy migration with allowFrom enabled, which would generally require the ability to influence that migration process. Once the flaw is exploited, the attacker can bypass authentication and acquire full access to named accounts.