CVE-2026-35664
OpenClaw < 2026.3.25 - DM Pairing Bypass via Legacy Card Callbacks
OpenClaw before 2026.3.25 contains an authentication bypass vulnerability in raw card send surface that allows unpaired recipients to mint legacy callback payloads. Attackers can send raw card commands to bypass DM pairing restrictions and reach callback handling without proper authorization.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
OpenClaw < 2026.3.25 - DM Pairing Bypass via Legacy Card Callbacks
OpenClaw before 2026.3.25 contains an authentication bypass vulnerability in raw card send surface that allows unpaired recipients to mint legacy callback payloads. Attackers can send raw card commands to bypass DM pairing restrictions and reach callback handling without proper authorization.
- Record
CVE-2026-35664- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-288
- Updated
- 2026-11-02
EUVDEUVD-2026-21474
OpenClaw before 2026.3.25 contains an authentication bypass vulnerability in raw card send surface that allows unpaired recipients to mint legacy callback payloads. Attackers can send raw card commands to bypass DM pairing restrictions and reach callback handling without proper authorization.
- Record
EUVD-2026-21474- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-77w2-crqv-cmv3 No score
OpenClaw: Feishu Raw Card Send Surface Can Mint Legacy Card Callbacks That Bypass DM Pairing
Summary
Feishu Raw card Send Surface Can Mint Legacy Card Callbacks That Bypass DM Pairing
Affected Packages / Versions
- Package:
openclaw - Affected versions:
<= 2026.3.24 - First patched version:
2026.3.25 - Latest published npm version at verification time:
2026.3.24
Details
Feishu raw card sends could previously mint legacy callback payloads that bypassed DM pairing and let unpaired recipients reach callback handling. Commit 81c45976db532324b5a0918a70decc19520dc354 rejects legacy raw-card command payloads so callbacks stay on the normal paired path.
Verified vulnerable on tag v2026.3.24 and fixed on main by commit 81c45976db532324b5a0918a70decc19520dc354.
Fix Commit(s)
81c45976db532324b5a0918a70decc19520dc354
- Record
GHSA-77w2-crqv-cmv3- Weakness
- CWE-288, CWE-863
- Updated
- 2026-11-02
NVD
OpenClaw before 2026.3.25 contains an authentication bypass vulnerability in raw card send surface that allows unpaired recipients to mint legacy callback payloads. Attackers can send raw card commands to bypass DM pairing restrictions and reach callback handling without proper authorization.
- Record
CVE-2026-35664- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-288
- Updated
- 2026-11-02
OSV
OpenClaw < 2026.3.25 - DM Pairing Bypass via Legacy Card Callbacks
OpenClaw before 2026.3.25 contains an authentication bypass vulnerability in raw card send surface that allows unpaired recipients to mint legacy callback payloads. Attackers can send raw card commands to bypass DM pairing restrictions and reach callback handling without proper authorization.
- Record
CVE-2026-35664- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-288
- Updated
- 2026-11-02
OSVGHSA-77w2-crqv-cmv3 No score
OpenClaw: Feishu Raw Card Send Surface Can Mint Legacy Card Callbacks That Bypass DM Pairing
Summary
Feishu Raw card Send Surface Can Mint Legacy Card Callbacks That Bypass DM Pairing
Affected Packages / Versions
- Package:
openclaw - Affected versions:
<= 2026.3.24 - First patched version:
2026.3.25 - Latest published npm version at verification time:
2026.3.24
Details
Feishu raw card sends could previously mint legacy callback payloads that bypassed DM pairing and let unpaired recipients reach callback handling. Commit 81c45976db532324b5a0918a70decc19520dc354 rejects legacy raw-card command payloads so callbacks stay on the normal paired path.
Verified vulnerable on tag v2026.3.24 and fixed on main by commit 81c45976db532324b5a0918a70decc19520dc354.
Fix Commit(s)
81c45976db532324b5a0918a70decc19520dc354
- Record
GHSA-77w2-crqv-cmv3- Weakness
- CWE-288, CWE-863
- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-35664 is a medium vulnerability (CVSS 6.9) in Openclaw, published March 29, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.29%, the 21st percentile. Fixed in openclaw 2026.3.28.
References
github.com/openclaw/openclaw/security/advisories/GHSA-77w2-crqv-cmv3
vulncheck.com/advisories/openclaw-dm-pairing-bypass-via-legacy-card-callbacks
nvd.nist.gov/vuln/detail/CVE-2026-35664