CVE-2026-28475: OpenClaw Auth Bypass Vulnerability

CVE-2026-28475 Overview

OpenClaw versions prior to 2026.2.13 contain a timing attack vulnerability in the hook token validation mechanism. The application uses non-constant-time string comparison for hook token validation, allowing attackers to infer tokens through timing measurements. Remote attackers with network access to the hooks endpoint can exploit timing side-channels across multiple requests to gradually recover the authentication token, potentially leading to unauthorized access to webhook functionality.

Critical Impact

Attackers can exploit timing side-channel vulnerabilities to incrementally recover authentication tokens, bypassing security controls and gaining unauthorized access to protected webhook endpoints.

Affected Products

• OpenClaw versions prior to 2026.2.13

Discovery Timeline

• 2026-03-05 - CVE CVE-2026-28475 published to NVD
• 2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-28475

Vulnerability Analysis

This vulnerability is classified under CWE-208 (Observable Timing Discrepancy), a cryptographic side-channel vulnerability category. The core issue stems from OpenClaw's use of standard string comparison operations for validating hook authentication tokens. Standard string comparison functions typically compare characters sequentially and return immediately upon finding a mismatch. This behavior creates measurable timing differences that correlate with how many characters of the input match the valid token.

An attacker can exploit this by sending multiple authentication requests with systematically varied token values and measuring the response times. By analyzing these timing differences across many requests, an attacker can determine correct token characters one position at a time, eventually reconstructing the entire authentication token.

Root Cause

The root cause is the use of non-constant-time string comparison for security-critical token validation. When comparing strings character by character, standard comparison functions exit early upon finding the first mismatched character. This creates timing variations where requests with more correct leading characters take slightly longer to process than those with incorrect characters at the beginning.

Attack Vector

The vulnerability is exploitable over the network by any attacker who can send requests to the OpenClaw hooks endpoint. The attack requires no authentication or user interaction but does require multiple requests to gather sufficient timing data. The attacker sends numerous crafted requests with varied token values while precisely measuring response times. Statistical analysis of these timing differences reveals information about the correct token value, allowing character-by-character recovery of the authentication secret.

The attack complexity is considered high due to the need for precise timing measurements and statistical analysis, which can be affected by network jitter and server load variations. However, local network attacks or attacks from nearby network positions significantly increase reliability.

Detection Methods for CVE-2026-28475

Indicators of Compromise

• Unusual patterns of authentication requests to webhook endpoints with systematically varied token values
• High volumes of failed authentication attempts from a single source in short time periods
• Requests exhibiting sequential or brute-force-like patterns targeting the hooks endpoint

Detection Strategies

• Monitor for abnormal request patterns to authentication endpoints, particularly rapid successive requests with minimal variation
• Implement rate limiting and anomaly detection on webhook authentication endpoints
• Review web server logs for unusual timing correlation attacks or enumeration attempts

Monitoring Recommendations

• Enable detailed logging on webhook endpoints to capture authentication attempt patterns
• Deploy network monitoring to detect timing attack signatures and suspicious request volumes
• Configure alerts for authentication failure thresholds on the hooks endpoint

How to Mitigate CVE-2026-28475

Immediate Actions Required

• Upgrade OpenClaw to version 2026.2.13 or later immediately
• Review webhook token security and consider rotating tokens after applying the patch
• Implement additional rate limiting on webhook endpoints as a defense-in-depth measure

Patch Information

The vulnerability has been addressed in OpenClaw version 2026.2.13. The fix implements constant-time comparison for hook token validation, eliminating the timing side-channel. Technical details of the fix are available in the GitHub Commit Update.

Additional information is available from the GitHub Security Advisory and the VulnCheck Timing Attack Advisory.

Workarounds

• Implement network-level access controls to restrict access to webhook endpoints to trusted IP ranges only
• Deploy a reverse proxy or web application firewall with rate limiting capabilities in front of OpenClaw
• Consider adding additional authentication layers such as mutual TLS for webhook integrations

# Example: Restrict webhook endpoint access via firewall rules
# Allow only trusted webhook sources
iptables -A INPUT -p tcp --dport 443 -s TRUSTED_IP_RANGE -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -m string --string "/hooks" --algo bm -j DROP