The vulnerability enables attackers to send unauthenticated requests to the Feishu webhook or card-action endpoint, bypassing the expected authentication checks. Because the missing or blank encryptKey and callback token values are treated as valid, the request reaches the internal command dispatch and allows arbitrary command execution. This is a classic authentication bypass flaw, classified as CWE‑1188, which can lead to full compromise of the affected system.

The flaw is present in OpenClaw releases earlier than 2026.4.15. Any deployment that integrates Feishu webhook or card-action functionality and relies on a missing or empty encryptKey configuration, or an unset callback token, is susceptible to the bypass.

The CVSS score of 9.2 marks it as critical. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Based on the described mechanism, the likely attack vector is remote over the network; an attacker can craft unauthenticated HTTP requests directed at the webhook endpoint to trigger arbitrary commands.