OpenClaw versions prior to 2026.4.20 contain an improper authorization flaw in the paired‑device pairing management module. A user session that has limited pairing‑device scope can enumerate and act on pending pairing requests that belong to devices unrelated to the session. This allows the attacker to approve or manipulate requests for devices that were not originally within their control, violating isolation expectations and potentially enabling unauthorized device access.

The affected product is OpenClaw by OpenClaw. All releases before 2026.4.20 are vulnerable, regardless of minor patch levels. The vulnerability exists in the Node.js based implementation of OpenClaw, as indicated by the CPE reference.

The CVSS score is 5.3, indicating a moderate security impact; the EPSS score of <1% suggests a low likelihood of widespread exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attacking requires gaining paired‑device access (an authenticated session with permissions to view pairing requests). Once in scope, the attacker can enumerate device identifiers and trigger approval or decline actions on unrelated pending requests. The impact is confined to the same gateway scope, but it still permits unauthorized manipulation of device pairing flows.