BREW-openclaw-cli-CVE-2026-28477 — OpenClaw Chutes manual OAuth state validation bypass can cause credential substitution

Affected: Homebrew: openclaw-cli

## Summary

The manual Chutes OAuth login flow could accept attacker-controlled callback input in a way that bypassed OAuth CSRF state validation, potentially resulting in credential substitution.

## Impact

If an attacker can convince a user to paste attacker-provided OAuth callback data during the manual login prompt, OpenClaw may exchange an attacker-obtained authorization code and persist tokens for the wrong Chutes account.

The automatic local callback flow is not affected (it validates state in the local HTTP callback handler).

## Affected Packages / Versions

- `openclaw` (npm): `<= 2026.2.13` when using the manual Chutes OAuth login flow.

## Fix

The manual flow now requires the full redirect URL (must include `code` and `state`), validates the returned `state` against the expected value, and rejects code-only pastes.

## Fix Commit(s)

- a99ad11a4107ba8eac58f54a3c1a8a0cf5686f47

Thanks @aether-ai-agent for reporting.

CVE-2026-28477 — OpenClaw < 2026.2.14 - OAuth State Validation Bypass in Manual Chutes Login Flow

Affected: OpenClaw

OpenClaw versions prior to 2026.2.14 contain an oauth state validation bypass vulnerability in the manual Chutes login flow that allows attackers to bypass CSRF protection. An attacker can convince a user to paste attacker-controlled OAuth callback data, enabling credential substitution and token persistence for unauthorized accounts.

Most recent entries from all

BREW-openclaw-cli-CVE-2026-28477 — OpenClaw Chutes manual OAuth state validation bypass can cause credential substitution

CVE-2026-28477 — OpenClaw < 2026.2.14 - OAuth State Validation Bypass in Manual Chutes Login Flow