OpenClaw Dashboard version 3.0.0 stores the username submitted during a failed login directly in its audit log without any escaping and later renders that log entry via innerHTML in the administrator notification panel. This stored cross‑site scripting flaw enables an unauthenticated attacker to inject arbitrary HTML and JavaScript that executes under an administrator’s session, providing the attacker with the ability to interact with privileged endpoints such as agent instruction file editing and configuration changes.

The vulnerability impacts the OpenClaw Dashboard application produced by tugcantopaloglu. Only version 3.0.0 is mentioned as affected; no other versions or patches are specified in the available data.

With a CVSS score of 9.3 the flaw is categorized as critical. The EPSS score is 0.00338, indicating a very low exploitation probability, and the issue is not listed in CISA’s KEV catalog. Because the attack allows any unauthenticated user to craft a malicious username in a standard login POST request, the attacker can trigger the vulnerability without needing to authenticate. When an administrator opens the notification panel, the unescaped log entry is rendered, and the injected script runs in the admin’s context, thereby compromising the confidentiality, integrity, and availability of the system for that privileged user.