OpenClaw releases prior to 2026.5.26 contain a flaw that allows a lower‑trust caller or an input path configured with reduced trust to bypass the non-browser rate limits imposed on WebSocket authentication attempts. This weakness permits repeated authentication requests from untrusted sources, potentially exhausting gateway resources and degrading service availability. The vulnerability is identified as CWE‑307, indicating improper restriction of resource usage.

The affected product is OpenClaw. Versions older than 2026.5.26 are vulnerable; the issue is present when the WebSocket authentication feature is enabled and reachable by lower-trust inputs, including external API endpoints (inferred).

The CVSS score of 6.3 classifies the risk as medium, while the EPSS score of less than 1% indicates a very low probability of exploitation today. The vulnerability is not listed in CISA’s KEV catalog, suggesting no known large-scale exploits. An attacker would need to be able to reach the WebSocket authentication endpoint from a less‑trusted source; once reached, the attacker could repeatedly attempt authentication until server resources are depleted.