OpenClaw before 2026.4.2 contains a timing side channel in shared-secret comparison call sites that perform early length-mismatch checks instead of fixed-length comparison helpers. The vulnerability allows attackers to measure timing differences and leak the length of shared secrets, thereby weakening constant‑time handling of secrets and potentially aiding further attacks on authentication mechanisms.

All OpenClaw releases prior to 2026.4.2 are affected, with the OpenClaw application itself as the impacted product.

The CVSS score of 6.3 indicates a moderate severity vulnerability. The EPSS score is not available, and the defect is not listed in the CISA KEV catalog. The likely attack vector involves an adversary able to measure the timing of authentication requests—either from a network perspective or via local execution. Successful exploitation can expose secret-length information, reducing the effectiveness of security controls that rely on constant‑time comparisons.