#VU125209 Authentication bypass using an alternate path or channel in OpenClaw
Published: April 8, 2026
Vulnerability identifier: #VU125209
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: N/A
CWE-ID: CWE-288
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
OpenClaw
OpenClaw
Software vendor:
OpenClaw
OpenClaw
Description
The vulnerability allows a remote user to reach callback handling without DM pairing.
The vulnerability exists due to authentication bypass using an alternate path or channel in the Feishu raw card send surface when processing legacy callback payloads. A remote user can send a specially crafted raw card command payload to reach callback handling without DM pairing.
Unpaired recipients can reach the legacy callback path.
Remediation
Install security update from vendor's website.