N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-p464-m8x6-vhv8

GHSA-p464-m8x6-vhv8: OpenClaw: MS Teams webhook parses body before JWT validation, enabling unauthenticated resource exhaustion

Summary

MS Teams webhook parses body before JWT validation, enabling unauthenticated resource exhaustion

Current Maintainer Triage

Status: open
Normalized severity: medium
Assessment: v2026.3.28 still parses Teams JSON after only a Bearer-prefix gate and before real JWT validation, and the auth-before-parse fix is not yet shipped.

Affected Packages / Versions

Package: openclaw (npm)
Latest published npm version: 2026.3.31
Vulnerable version range: <=2026.3.28
Patched versions: >= 2026.3.31
First stable tag containing the fix: v2026.3.31

Fix Commit(s)

3834d47099dd13c8244ed6de8b9ea9855c553623 — 2026-03-30T13:46:40+01:00

OpenClaw thanks @AntAISecurityLab for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-p464-m8x6-vhv8

GHSA-p464-m8x6-vhv8:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	<= 2026.3.28	2026.3.31

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the provided patch commit 3834d47099dd13c8244ed6de8b9ea9855c553623 clearly indicates the source of the vulnerability. The file extensions/msteams/src/monitor.ts contains the function monitorMSTeamsProvider, which configures the middleware for an Express.js application. The diff shows that the express.json() middleware was moved from before the JWT validation middleware to after it. The vulnerability description confirms this, stating "MS Teams webhook parses body before JWT validation, enabling unauthenticated resource exhaustion." The vulnerable function is monitorMSTeamsProvider because it is responsible for the incorrect ordering of the middleware. When a malicious request is sent, this function's configuration causes the application to parse the body before authenticating the request, leading to the vulnerability. The associated test file extensions/msteams/src/monitor.lifecycle.test.ts was also updated to include a specific test case, "runs JWT validation before JSON body parsing", which verifies that the fix is working as intended by checking the middleware order.

Vulnerable functions

monitorMSTeamsProvider

extensions/msteams/src/monitor.ts

The vulnerability exists within the `monitorMSTeamsProvider` function, which is responsible for setting up the Express.js web server for the MS Teams webhook. In the vulnerable version, the `express.json()` middleware, which parses the incoming request body, was registered before the JWT authentication middleware. This meant that for every incoming request, the application would first read and parse the entire JSON body before checking if the request was authenticated. An unauthenticated attacker could exploit this by sending large request bodies, forcing the server to expend significant CPU and memory resources, leading to a resource exhaustion denial-of-service (DoS) vulnerability. The patch corrected this by moving the `express.json()` middleware to after the authentication middleware, ensuring that unauthenticated requests are rejected before any costly body parsing occurs.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.