The vulnerability allows attackers to call the session_status function without the protective sandbox, bypassing the tool's configured visibility restrictions. As a result, unauthorized users can obtain session data that should be protected, potentially exposing sensitive authentication tokens or user information. The weakness is an authorization bypass, identified as CWE-863, and is primarily an information disclosure risk.

The flaw is present in all releases of OpenClaw OpenClaw prior to version 2026.3.31. Clients using versions earlier than that should consider them vulnerable, regardless of the underlying OS or runtime environment. The affected component is the session_status API implemented in the core client library.

The CVSS v3.1 score of 5.3 indicates a moderate severity. The EPSS score of less than 1% suggests that exploitation is currently low probability, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the attack could succeed if an attacker can trigger an unsandboxed invocation of the affected API, which may be possible in environments with elevated privileges or misconfigured APIs. In those scenarios, the attacker could read session details and potentially use them for further exploitation.