The vulnerability allows an attacker to craft cross‑origin redirect chains that forward Authorization headers sent to the media download endpoint, resulting in the accidental exposure of authentication credentials. This credential leakage can provide an attacker with valid tokens or credentials that may grant unauthorized access to sensitive resources. The weakness is identified as a credential exposure flaw, consistent with the CWE-522 classification.

The issue affects installations of OpenClaw running any node.js version before 2026.3.31. All deployments that expose media download functionality without restricting cross‑origin redirects are susceptible.

The CVSS score of 6.0 indicates medium severity, while the EPSS score of less than 1% suggests a low probability of active exploitation. The vulnerability is not listed in the CISA KEV catalog, and no public exploit has been reported. Attackers would need to induce a legitimate browser to follow a malicious cross‑origin redirect chain, a scenario that is plausible for phishing or compromised sites, but requires specific setup rather than an arbitrary remote exploitation.