#VU125247 Insufficient Session Expiration in OpenClaw

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU125247

#VU125247 Insufficient Session Expiration in OpenClaw

Published: April 8, 2026


Vulnerability identifier: #VU125247
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: N/A
CWE-ID: CWE-613
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vulnerable software:
OpenClaw
Software vendor:
OpenClaw

Description

The vulnerability allows a remote user to maintain access to an active WebSocket session after credential rotation.

The vulnerability exists due to improper session expiration in the WebSocket session handling for the gateway device.token.rotate operation when rotating device credentials. A remote user can continue using an already-authenticated WebSocket session to maintain access to an active WebSocket session after credential rotation.

This is a post-compromise revocation gap affecting already-authenticated sessions.


Remediation

Install security update from vendor's website.

External links