N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-gc9r-867r-j85f

GHSA-gc9r-867r-j85f: OpenClaw: Microsoft Teams SSO invoke handler missed sender authorization checks

Summary

Microsoft Teams SSO invoke handler missed sender authorization checks.

Affected Packages / Versions

Package: openclaw
Ecosystem: npm
Affected versions: >= 2026.4.10 < 2026.4.14
Patched versions: >= 2026.4.14

Impact

Microsoft Teams SSO signin invoke handling could process an invoke from a sender before applying the same sender allowlist checks used by normal message handling.

Technical Details

The fix routes SSO invoke handling through the Teams sender authorization path and adds coverage for denied senders.

Fix

The issue was fixed in #66033. The first stable tag containing the fix is v2026.4.14, and openclaw@2026.4.14 includes the fix.

Fix Commit(s)

80b1fa17bfc3f6a668492f0326ea52f48bb89776
PR: #66033

Release Process Note

Users should upgrade to openclaw 2026.4.14 or newer. The latest npm release, 2026.4.14, already includes the fix.

Credits

Thanks to @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-gc9r-867r-j85f

GHSA-gc9r-867r-j85f:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	>= 2026.4.10, < 2026.4.14	2026.4.14

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as GHSA-gc9r-867r-j85f, lies in the openclaw package's handling of Microsoft Teams SSO invoke activities. The core issue is a missing authorization check. By analyzing the provided patch commit 80b1fa17bfc3f6a668492f0326ea52f48bb89776, I identified the exact location of the fix.

The patch modifies extensions/msteams/src/monitor-handler.ts. The function registerMSTeamsHandlers is responsible for setting up activity handlers. Inside this function, the onInvoke handler for SSO activities (signin/tokenExchange, signin/verifyState) was missing a crucial step. It would proceed with the SSO flow without first checking if the sender was on the configured allowlist.

The fix introduces a new function, isSigninInvokeAuthorized, which centralizes sender authorization logic. This function is now called at the beginning of the SSO invoke handling process within registerMSTeamsHandlers. If the sender is not authorized, the function returns early, preventing any further processing of the SSO request.

The vulnerable function is therefore registerMSTeamsHandlers, as it contained the flawed logic that failed to perform the necessary authorization. During runtime exploitation, this function's onInvoke handler would be on the call stack when an unauthorized SSO invoke is received.

Vulnerable functions

registerMSTeamsHandlers

extensions/msteams/src/monitor-handler.ts

The `registerMSTeamsHandlers` function sets up handlers for various Microsoft Teams activities. Within this function, an `onInvoke` handler is registered to process activities like 'signin/tokenExchange' and 'signin/verifyState', which are used for Single Sign-On (SSO). Before the patch, this handler would immediately process the invoke without verifying if the sender was authorized according to the configured sender policies (allowlists). This allowed an unauthenticated or unauthorized user to trigger the initial phase of the SSO flow. The vulnerability is the missing authorization check, which was added in the patch via the `isSigninInvokeAuthorized` function call.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-gc9r-867r-j85f: OpenClaw: Microsoft Teams SSO invoke handler missed sender authorization checks

Summary

Affected Packages / Versions

Impact

Technical Details

Fix

Fix Commit(s)

Release Process Note

Credits

GHSA-gc9r-867r-j85f:

N/A

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Technical Details

Basic Information

Basic Information

GHSA-gc9r-867r-j85f: OpenClaw: Microsoft Teams SSO invoke handler missed sender authorization checks

Summary

Affected Packages / Versions

Impact

Technical Details

Fix

Fix Commit(s)

Release Process Note

Credits

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

N/A

N/A

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI