Crabbox versions earlier than 0.9.0 contain an authentication bypass flaw. The verifyUserToken() function mistakenly accepts user‑token payloads that include an admin claim. An attacker can manipulate the token payload, set admin:true, sign it with HMAC‑SHA256, and use it to access coordinator routes that are otherwise restricted to administrator accounts. The result is full admin privileges over the coordinator, allowing the attacker to view leases, manage pool state, and force resource releases, thereby compromising confidentiality, integrity, and availability of the service.

The vulnerability affects the openclaw:crabbox product, specifically all releases prior to version 0.9.0. Users running versions older than 0.9.0 are susceptible; the 0.9.0 release and newer contain the fix.

The flaw carries a CVSS score of 7.7, indicating high severity. EPSS information is not available, and the issue is not listed in the CISA KEV catalog, yet the ability to elevate privileges from a regular user to a coordinator admin makes the risk credible. No specific exploit has been reported, but the attack requires an attacker to craft a valid HMAC‑SHA256 signed token containing an admin claim; if the attacker can obtain the signing secret or can re‑use a valid non‑admin token, the bypass can be executed remotely, likely via API or web request.