Vulnerability Description
OpenClaw before 2026.3.31 contains an authentication rate limiting bypass vulnerability that allows attackers to circumvent shared authentication protections using fake device tokens. Attackers can exploit the mixed WebSocket authentication flow to bypass rate limiting controls and conduct brute force attacks against weak shared passwords.
CVSS Score
LOW
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Openclaw | Openclaw | < 2026.3.31 |
Related Weaknesses (CWE)
References
- https://github.com/openclaw/openclaw/commit/af0c0862f22ca4492406a3103d05e3628f94Patch
- https://github.com/openclaw/openclaw/security/advisories/GHSA-6p8r-6m93-557fVendor Advisory
- https://www.vulncheck.com/advisories/openclaw-authentication-rate-limiting-bypasThird Party Advisory
FAQ
What is CVE-2026-41333?
CVE-2026-41333 is a vulnerability with a CVSS score of 3.7 (LOW). OpenClaw before 2026.3.31 contains an authentication rate limiting bypass vulnerability that allows attackers to circumvent shared authentication protections using fake device tokens. Attackers can ex...
How severe is CVE-2026-41333?
CVE-2026-41333 has been rated LOW with a CVSS base score of 3.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-41333?
Check the references section above for vendor advisories and patch information. Affected products include: Openclaw Openclaw.