CVE-2026-28464: OpenClaw Auth Bypass Vulnerability

CVE-2026-28464 Overview

OpenClaw versions prior to 2026.2.12 contain a timing attack vulnerability in the hook token authentication mechanism. The application uses non-constant-time string comparison for validating hook tokens, which allows remote attackers to infer authentication tokens through precise timing measurements. By making multiple requests to the hooks endpoint and analyzing response times, attackers can gradually determine the complete authentication token character by character.

Critical Impact

Remote attackers with network access to the OpenClaw hooks endpoint can exploit timing side-channel vulnerabilities to extract authentication tokens, potentially gaining unauthorized access to protected webhook functionality.

Affected Products

• OpenClaw versions prior to 2026.2.12

Discovery Timeline

• 2026-03-05 - CVE CVE-2026-28464 published to NVD
• 2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-28464

Vulnerability Analysis

This vulnerability falls under CWE-208 (Observable Timing Discrepancy), a category of side-channel attacks that exploit measurable differences in system response times. The core issue lies in how OpenClaw performs token validation for its webhook authentication system—using standard string comparison operators instead of cryptographically-secure constant-time comparison functions.

When comparing strings character by character, standard comparison functions return early upon encountering the first mismatched character. This creates a measurable timing difference: a token that matches more characters takes slightly longer to fail validation than one that fails on the first character. Sophisticated attackers can exploit these microsecond-level differences across many requests to systematically deduce each character of the secret token.

Root Cause

The vulnerability stems from improper implementation of secret comparison in the authentication module. The original code in src/gateway/auth.ts utilized standard string comparison methods that do not execute in constant time. This allows an attacker to perform a byte-by-byte brute force attack by measuring response latencies, significantly reducing the complexity required to discover valid authentication tokens compared to exhaustive search.

Attack Vector

The attack requires network access to the OpenClaw hooks endpoint. An attacker sends multiple authentication requests with varying token guesses, carefully measuring the time each request takes to receive a response. By statistically analyzing timing variations across hundreds or thousands of requests, the attacker can determine when additional characters of their guessed token match the actual secret. This process is repeated for each character position until the complete token is recovered.

// Vulnerable pattern (simplified representation):
// Standard string comparison returns early on mismatch
if (providedToken === secretToken) {
  // Authenticate
}

// Secure pattern from patch:
// Uses constant-time comparison from safeEqualSecret
import { safeEqualSecret } from "../security/secret-equal.js";
// Comparison time is independent of match position

The actual patch modifies src/gateway/auth.ts to import and use a secure comparison function:

 import type { IncomingMessage } from "node:http";
-import { timingSafeEqual } from "node:crypto";
 import type { GatewayAuthConfig, GatewayTailscaleMode } from "../config/config.js";
 import { readTailscaleWhoisIdentity, type TailscaleWhoisIdentity } from "../infra/tailscale.js";
+import { safeEqualSecret } from "../security/secret-equal.js";
 import {
   isLoopbackAddress,
   isTrustedProxyAddress,

Source: GitHub Commit Changes

Detection Methods for CVE-2026-28464

Indicators of Compromise

• Unusually high volume of failed authentication attempts to the hooks endpoint from single IP addresses or subnets
• Requests to the hooks endpoint with systematically varying token values exhibiting patterns consistent with character-by-character guessing
• Authentication log entries showing sequential token attempts with incrementally different prefixes

Detection Strategies

• Implement rate limiting and anomaly detection on the hooks authentication endpoint to identify statistical patterns indicative of timing attacks
• Monitor for automated request patterns with consistent timing intervals that suggest timing measurement collection
• Deploy network intrusion detection rules to flag suspicious repeated authentication attempts with varying token values

Monitoring Recommendations

• Enable detailed logging for all authentication attempts to the hooks endpoint including request timestamps and source IPs
• Configure alerting thresholds for authentication failures that exceed normal operational baselines
• Review access logs periodically for patterns that suggest timing-based reconnaissance activity

How to Mitigate CVE-2026-28464

Immediate Actions Required

• Upgrade OpenClaw to version 2026.2.12 or later immediately
• Review hook authentication logs for any suspicious activity patterns that may indicate prior exploitation attempts
• Rotate all hook authentication tokens as a precautionary measure after applying the patch
• Consider implementing additional authentication controls such as IP allowlisting for webhook endpoints

Patch Information

The vulnerability has been addressed in OpenClaw version 2026.2.12. The fix replaces standard string comparison with a constant-time comparison function (safeEqualSecret) that prevents timing-based inference of secret values. The security patch is available in commit 113ebfd6a23c4beb8a575d48f7482593254506ec. For detailed information, refer to the GitHub Security Advisory GHSA-jmm5-fvh5-gf4p and the VulnCheck Advisory.

Workarounds

• Restrict network access to the hooks endpoint using firewall rules or network segmentation until the patch can be applied
• Implement aggressive rate limiting on authentication endpoints to make timing attacks impractical
• Place the hooks endpoint behind a reverse proxy or WAF with timing normalization capabilities

# Example: Rate limiting hooks endpoint with iptables
iptables -A INPUT -p tcp --dport 443 -m string --string "/hooks" --algo bm \
  -m recent --name hooks_limit --set
iptables -A INPUT -p tcp --dport 443 -m string --string "/hooks" --algo bm \
  -m recent --name hooks_limit --update --seconds 1 --hitcount 10 -j DROP