https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 20:22:22 +0000 https://vulnerability.circl.lu/vuln/cve-2026-3691 <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw Client PKCE Verifier Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose stored credentials on affected installations of OpenClaw. User interaction is required to exploit this vulnerability in that the target must initiate an OAuth authorization flow.</p> <p>The specific flaw exists within the implementation of OAuth authorization. The issue results from the exposure of sensitive data in the authorization URL query string. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-29381.</p> <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw Client PKCE Verifier Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose stored credentials on affected installations of OpenClaw. User interaction is required to exploit this vulnerability in that the target must initiate an OAuth authorization flow.</p> <p>The specific flaw exists within the implementation of OAuth authorization. The issue results from the exposure of sensitive data in the authorization URL query string. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-29381.</p> https://vulnerability.circl.lu/vuln/cve-2026-3691 https://vulnerability.circl.lu/vuln/ghsa-6g25-pc82-vfwp <p><strong>Affected:</strong> npm: openclaw</p> <p>### Summary</p> <p>The affected surface is the OpenClaw macOS app onboarding flow, and the macOS app is currently in **beta**. In that beta onboarding flow, Anthropic OAuth used the PKCE `code_verifier` value as OAuth `state`, exposing that secret in front-channel URL state.</p> <p>### Affected Packages / Versions</p> <p>- Package: `openclaw` (npm) - Affected versions: `&lt;= 2026.2.24` (latest published npm at triage time) - Affected surface: macOS app beta onboarding path (`apps/macos`) - Not affected: core CLI/gateway onboarding paths - Patched version : `2026.2.25`</p> <p>### Impact</p> <p>Scope is limited to the macOS beta onboarding OAuth path. Exploitation required obtaining both OAuth authorization artifacts and exposed `state` values during that flow.</p> <p>### Remediation</p> <p>OpenClaw removed Anthropic OAuth sign-in from macOS onboarding and now supports setup-token-only Anthropic subscription auth in this path.</p> <p>### Fix Commit(s)</p> <p>- `8f3310000a8b0c11eced054c2cdb6fb27803511a`</p> <p>### Release Process Note</p> <p>`patched_versions` is pre-set to the release (`2026.2.25`). Advisory published with npm release `2026.2.25`.2.25` is published, this advisory is published.</p> <p>OpenClaw thanks @zdi-disclosures for reporting.</p> <p><strong>Affected:</strong> npm: openclaw</p> <p>### Summary</p> <p>The affected surface is the OpenClaw macOS app onboarding flow, and the macOS app is currently in **beta**. In that beta onboarding flow, Anthropic OAuth used the PKCE `code_verifier` value as OAuth `state`, exposing that secret in front-channel URL state.</p> <p>### Affected Packages / Versions</p> <p>- Package: `openclaw` (npm) - Affected versions: `&lt;= 2026.2.24` (latest published npm at triage time) - Affected surface: macOS app beta onboarding path (`apps/macos`) - Not affected: core CLI/gateway onboarding paths - Patched version : `2026.2.25`</p> <p>### Impact</p> <p>Scope is limited to the macOS beta onboarding OAuth path. Exploitation required obtaining both OAuth authorization artifacts and exposed `state` values during that flow.</p> <p>### Remediation</p> <p>OpenClaw removed Anthropic OAuth sign-in from macOS onboarding and now supports setup-token-only Anthropic subscription auth in this path.</p> <p>### Fix Commit(s)</p> <p>- `8f3310000a8b0c11eced054c2cdb6fb27803511a`</p> <p>### Release Process Note</p> <p>`patched_versions` is pre-set to the release (`2026.2.25`). Advisory published with npm release `2026.2.25`.2.25` is published, this advisory is published.</p> <p>OpenClaw thanks @zdi-disclosures for reporting.</p> https://vulnerability.circl.lu/vuln/ghsa-6g25-pc82-vfwp