https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-28T16:54:14.130174+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-41333 CVE-2026-41333 — OpenClaw < 2026.3.31 - Authentication Rate Limiting Bypass via Fake DeviceToken 2026-09-28T16:54:14.155798+00:00

Affected: OpenClaw

OpenClaw before 2026.3.31 contains an authentication rate limiting bypass vulnerability that allows attackers to circumvent shared authentication protections using fake device tokens. Attackers can exploit the mixed WebSocket authentication flow to bypass rate limiting controls and conduct brute force attacks against weak shared passwords.

 https://vulnerability.circl.lu/vuln/ghsa-6p8r-6m93-557f GHSA-6p8r-6m93-557f — OpenClaw: Fake DeviceToken Bypasses Shared Auth Rate Limiting 2026-09-28T16:54:14.155858+00:00

Affected: npm: openclaw

## Summary Fake DeviceToken Bypasses Shared Auth Rate Limiting

## Current Maintainer Triage - Status: narrow - Normalized severity: low - Assessment: Real in shipped mixed WS auth flow, but practical risk is mostly weak shared-password deployments since strong shared tokens remain non-bruteforceable.

## Affected Packages / Versions - Package: `openclaw` (npm) - Latest published npm version: `2026.3.31` - Vulnerable version range: `<=2026.3.28` - Patched versions: `>= 2026.3.31` - First stable tag containing the fix: `v2026.3.31`

## Fix Commit(s) - `af0c0862f22ca4492406a3103d05e3628f94cbe9` — 2026-03-31T09:08:57+09:00

## Release Process Note - The fix is already present in released version `2026.3.31`.

OpenClaw thanks @kexinoh of Tencent zhuque Lab (https://github.com/Tencent/AI-Infra-Guard) for reporting.