OpenClaw versions before 2026.4.8 suffer from a session‑management flaw where WebSocket connections that use a shared gateway token continue to remain active after the token is rotated, allowing an attacker who already holds a session to retain unauthorized access. This persistence of authenticated sessions is a weakness classified as CWE‑613. The consequence is that the attacker can keep an existing connection alive and potentially exercise privileged operations during the period after token rotation, though no new credentials are required.

The vulnerable product is OpenClaw, a Node.js‑based web application framework. Any installation using a release prior to 2026.4.8 is affected; newer releases contain the fix.

The CVSS score of 2.3 indicates low severity, and EPSS is not available, with the vulnerability not listed in the CISA KEV catalog. The likely attack vector involves an attacker who already possesses an active WebSocket session before the shared gateway token is rotated; no new authentication is required to maintain the session. Accordingly, the risk is limited to the persistence of an existing session rather than elevation of privileges or system compromise.