N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-jmmg-jqc7-5qf4

GHSA-jmmg-jqc7-5qf4: OpenClaw's browser-origin WebSocket auth hardening gap could enable loopback password brute-force chains

This issue is a browser-origin WebSocket auth chain on local loopback deployments using password auth. It is serious, but conditional: an attacker must get the user to open a malicious page and then successfully guess the gateway password.

Context and Preconditions

OpenClaw’s web/gateway surface is designed for local use and trusted-operator workflows. In affected versions, a browser-origin client could combine three behaviors:

Origin checks not enforced for some non-Control-UI WebSocket client IDs.
Loopback auth attempts exempt from password-failure throttling.
Silent local pairing path available to browser-origin non-Control-UI clients.

Successful exploitation requires all of the following:

Gateway reachable on loopback (default).
Password auth mode in use.
Victim opens attacker-controlled web content.
Password is guessable within feasible brute-force/dictionary attempts.

Practical Impact

If the password is guessed, an attacker can establish an authenticated operator WebSocket session and invoke control-plane methods available to that role. This is not an unauthenticated internet-exposed RCE class issue by itself; it is a local browser-origin auth-hardening gap with meaningful impact under the conditions above.

Affected Packages / Versions

Package: openclaw (npm)
Affected versions: <=2026.2.24 (latest published npm version as of February 26, 2026)
Patched versions : >=2026.2.25

Fix Commit(s)

c736f11a16d6bc27ea62a0fe40fffae4cb071fdb

Fix Details

Enforce browser-origin checks for direct browser WebSocket clients beyond Control UI/Webchat (trusted-proxy forwarded flows remain supported).
Apply browser-origin auth failure throttling with loopback exemption disabled.
Block silent auto-pairing for non-Control-UI browser-origin clients.

Release Process Note

patched_versions is pre-set to the planned next npm release (2026.2.25) so once that release is published, the advisory is published.

OpenClaw thanks @luz-oasis for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-jmmg-jqc7-5qf4

GHSA-jmmg-jqc7-5qf4:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	<= 2026.2.24	2026.2.25

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a combination of three weaknesses in OpenClaw's WebSocket gateway authentication for browser-based clients, particularly on loopback connections. The core of the issue lies in the handling of incoming WebSocket messages, which is managed by the attachGatewayWsMessageHandler function in src/gateway/server/ws-connection/message-handler.ts.

The analysis of the patch commit c736f11a16d6bc27ea62a0fe40fffae4cb071fdb reveals the following:

Lack of Rate Limiting: The description notes that 'Loopback auth attempts exempt from password-failure throttling.' The patch addresses this by creating a new browserAuthRateLimiter in startGatewayServer with exemptLoopback: false. This new limiter is then passed down the call chain and conditionally applied within attachGatewayWsMessageHandler for any request that has a browser Origin header. This ensures that repeated password guessing from a malicious webpage is throttled, even when running on localhost.
Missing Origin Checks: The vulnerability existed because 'Origin checks not enforced for some non-Control-UI WebSocket client IDs.' The patch fixes this inside attachGatewayWsMessageHandler by modifying the condition for origin validation from if (isControlUi || isWebchat) to if (enforceBrowserOriginForAnyClient || isControlUi || isWebchat), thereby applying the check to a wider range of browser-based clients.
Silent Auto-Pairing: The vulnerability allowed a 'Silent local pairing path available to browser-origin non-Control-UI clients.' The patch restricts this by adding a new condition, !hasBrowserOriginHeader || isControlUi || isWebchat, to the logic that determines if silent pairing (allowSilentLocalPairing) is permitted within attachGatewayWsMessageHandler.

During an exploit, a malicious webpage would cause the victim's browser to send multiple WebSocket connection requests to the local OpenClaw gateway. Each of these malicious authentication attempts would be processed by the message handler within attachGatewayWsMessageHandler. Therefore, this function is the primary runtime indicator of the vulnerability being triggered. The startGatewayServer function is also included as it was modified to create the necessary infrastructure (the new rate limiter) for the fix, and is part of the vulnerable server's initialization process.

Vulnerable functions

attachGatewayWsMessageHandler

src/gateway/server/ws-connection/message-handler.ts

This function is responsible for handling incoming WebSocket messages, including connection and authentication requests. Prior to the patch, it had three weaknesses when handling requests from a browser client on a loopback (localhost) connection: 1) It did not enforce rate limiting on password authentication attempts, allowing for brute-force attacks. 2) It did not perform origin validation for all types of WebSocket clients, permitting cross-origin requests. 3) It allowed for silent, non-interactive device pairing for non-UI clients. The combination of these flaws enabled a malicious webpage to establish a WebSocket connection to the local gateway and brute-force the password to gain operator access.

startGatewayServer

src/gateway/server.impl.ts

This function is the entry point for starting the gateway server. It was modified to create and configure the new `browserAuthRateLimiter` which crucially disables the loopback exemption for rate limiting (`exemptLoopback: false`). While not directly handling the malicious input, its modification was essential to providing the mechanism to fix the rate-limiting bypass vulnerability. An attacker's repeated connection attempts would be processed by the server started by this function.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-jmmg-jqc7-5qf4: OpenClaw's browser-origin WebSocket auth hardening gap could enable loopback password brute-force chains

Context and Preconditions

Practical Impact

Affected Packages / Versions

Fix Commit(s)

Fix Details

Release Process Note

GHSA-jmmg-jqc7-5qf4:

N/A

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Basic Information

Basic Information

GHSA-jmmg-jqc7-5qf4: OpenClaw's browser-origin WebSocket auth hardening gap could enable loopback password brute-force chains

Context and Preconditions

Practical Impact

Affected Packages / Versions

Fix Commit(s)

Fix Details

Release Process Note

N/A

N/A

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Technical Details

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI