OpenClaw prior to 2026.5.26 contains an authorization bypass flaw that allows an attacker who controls a device paired to the target node to re‑establish node‑level WebSocket access after the token has been revoked. The flaw permits the paired device to resurrect token authority without additional approval, effectively extending unauthorized access indefinitely. This undermines the intended revocation controls and can let a compromised device persist in performing privileged operations.

Systems affected by this vulnerability are OpenClaw nodes running any version earlier than 2026.5.26. The flaw exists in the pairing‑scoped device session handling component that does not properly clear authority after revocation. Attackers only need a device that has previously been paired to the vulnerable node; no additional privileges are required beyond the existing pairing relationship.

The CVSS score of 8.7 indicates a high risk to the confidentiality and integrity of data accessed through the node. With an EPSS of less than 1%, the probability of exploitation is low, and the vulnerability is not currently listed in the CISA KEV catalog. Nonetheless, the attack path requires a paired device and the ability to trigger a revocation, which are plausible in many environments. Operators should assume that unpatched systems could be reused for sustained unauthorized activity once the session is re‑established.