{"id":"CVE-2026-3691","aliases":["EUVD-2026-21623","GHSA-4h5x-fjp7-jhq3","GHSA-6g25-pc82-vfwp"],"status":"published","title":"OpenClaw Client PKCE Verifier Information Disclosure Vulnerability","description":"OpenClaw Client PKCE Verifier Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose stored credentials on affected installations of OpenClaw. User interaction is required to exploit this vulnerability in that the target must initiate an OAuth authorization flow.\n\nThe specific flaw exists within the implementation of OAuth authorization. The issue results from the exposure of sensitive data in the authorization URL query string. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-29381.","severity":{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00477,"percentile":0.41683,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2026-03-03T00:39:40Z","modified":"2026-10-28T02:31:05Z","fixes":[{"ecosystem":"npm","package":"openclaw","fixed_in":["2026.2.25"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"openclaw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2026.2.24"},{"fixed":"2026.2.25"}]}]},{"source":"osv","ecosystem":"npm","package":"openclaw","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2026.2.25"}]}]}],"products":[{"vendor":"openclaw","product":"openclaw"}],"references":[{"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-229/","tags":["x_research-advisory","Third Party Advisory","advisory"]},{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-6g25-pc82-vfwp","tags":["vendor-advisory","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3691","tags":["advisory"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-229"},{"url":"https://github.com/advisories/GHSA-4h5x-fjp7-jhq3"},{"url":"https://github.com/openclaw/openclaw/commit/8f3310000a8b0c11eced054c2cdb6fb27803511a","tags":["web"]},{"url":"https://github.com/advisories/GHSA-6g25-pc82-vfwp"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/3xxx/CVE-2026-3691.json","tags":["advisory"]},{"url":"https://github.com/openclaw/openclaw","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-3691","title":"OpenClaw Client PKCE Verifier Information Disclosure Vulnerability","description":"OpenClaw Client PKCE Verifier Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose stored credentials on affected installations of OpenClaw. User interaction is required to exploit this vulnerability in that the target must initiate an OAuth authorization flow.\n\nThe specific flaw exists within the implementation of OAuth authorization. The issue results from the exposure of sensitive data in the authorization URL query string. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-29381.","status":"published","published":"2026-04-11T00:17:40.509Z","modified":"2026-04-13T17:42:24.369Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T13:48:58.05327Z"}],"euvd":[{"id":"EUVD-2026-21623","description":"OpenClaw Client PKCE Verifier Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose stored credentials on affected installations of OpenClaw. User interaction is required to exploit this vulnerability in that the target must initiate an OAuth authorization flow.\n\nThe specific flaw exists within the implementation of OAuth authorization. The issue results from the exposure of sensitive data in the authorization URL query string. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-29381.","status":"published","published":"2026-04-11T00:17:40Z","modified":"2026-04-13T17:42:24Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T19:24:27.467761Z"}],"ghsa":[{"id":"GHSA-4h5x-fjp7-jhq3","title":"OpenClaw Client PKCE Verifier Information Disclosure Vulnerability. This vulnerability allows...","description":"OpenClaw Client PKCE Verifier Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose stored credentials on affected installations of OpenClaw. User interaction is required to exploit this vulnerability in that the target must initiate an OAuth authorization flow.\n\nThe specific flaw exists within the implementation of OAuth authorization. The issue results from the exposure of sensitive data in the authorization URL query string. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-29381.","status":"published","published":"2026-04-11T03:30:29Z","modified":"2026-04-11T03:30:41Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:07:24.880377Z"},{"id":"GHSA-6g25-pc82-vfwp","title":"OpenClaw: macOS beta onboarding exposed PKCE verifier via OAuth state","description":"### Summary\n\nThe affected surface is the OpenClaw macOS app onboarding flow, and the macOS app is currently in **beta**.\nIn that beta onboarding flow, Anthropic OAuth used the PKCE `code_verifier` value as OAuth `state`, exposing that secret in front-channel URL state.\n\n### Affected Packages / Versions\n\n- Package: `openclaw` (npm)\n- Affected versions: `\u003c= 2026.2.24` (latest published npm at triage time)\n- Affected surface: macOS app beta onboarding path (`apps/macos`)\n- Not affected: core CLI/gateway onboarding paths\n- Patched version : `2026.2.25`\n\n### Impact\n\nScope is limited to the macOS beta onboarding OAuth path. Exploitation required obtaining both OAuth authorization artifacts and exposed `state` values during that flow.\n\n### Remediation\n\nOpenClaw removed Anthropic OAuth sign-in from macOS onboarding and now supports setup-token-only Anthropic subscription auth in this path.\n\n### Fix Commit(s)\n\n- `8f3310000a8b0c11eced054c2cdb6fb27803511a`\n\n### Release Process Note\n\n`patched_versions` is pre-set to the release (`2026.2.25`).\nAdvisory published with npm release `2026.2.25`.2.25` is published, this advisory is published.\n\nOpenClaw thanks @zdi-disclosures for reporting.","status":"published","published":"2026-03-03T00:39:40Z","modified":"2026-03-03T00:39:42Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:39:30.031684Z"}],"nvd":[{"id":"CVE-2026-3691","description":"OpenClaw Client PKCE Verifier Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose stored credentials on affected installations of OpenClaw. User interaction is required to exploit this vulnerability in that the target must initiate an OAuth authorization flow.\n\nThe specific flaw exists within the implementation of OAuth authorization. The issue results from the exposure of sensitive data in the authorization URL query string. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-29381.","status":"published","published":"2026-04-11T01:16:16.123Z","modified":"2026-06-17T10:44:00.807Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:12:14.37744Z"}],"osv":[{"id":"CVE-2026-3691","title":"OpenClaw Client PKCE Verifier Information Disclosure Vulnerability","description":"OpenClaw Client PKCE Verifier Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose stored credentials on affected installations of OpenClaw. User interaction is required to exploit this vulnerability in that the target must initiate an OAuth authorization flow.\n\nThe specific flaw exists within the implementation of OAuth authorization. The issue results from the exposure of sensitive data in the authorization URL query string. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-29381.","status":"published","published":"2026-04-11T00:17:40.509Z","modified":"2026-10-28T02:31:05.257950584Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:45:03.040464Z"},{"id":"GHSA-6g25-pc82-vfwp","title":"OpenClaw: macOS beta onboarding exposed PKCE verifier via OAuth state","description":"### Summary\n\nThe affected surface is the OpenClaw macOS app onboarding flow, and the macOS app is currently in **beta**.\nIn that beta onboarding flow, Anthropic OAuth used the PKCE `code_verifier` value as OAuth `state`, exposing that secret in front-channel URL state.\n\n### Affected Packages / Versions\n\n- Package: `openclaw` (npm)\n- Affected versions: `\u003c= 2026.2.24` (latest published npm at triage time)\n- Affected surface: macOS app beta onboarding path (`apps/macos`)\n- Not affected: core CLI/gateway onboarding paths\n- Patched version : `2026.2.25`\n\n### Impact\n\nScope is limited to the macOS beta onboarding OAuth path. Exploitation required obtaining both OAuth authorization artifacts and exposed `state` values during that flow.\n\n### Remediation\n\nOpenClaw removed Anthropic OAuth sign-in from macOS onboarding and now supports setup-token-only Anthropic subscription auth in this path.\n\n### Fix Commit(s)\n\n- `8f3310000a8b0c11eced054c2cdb6fb27803511a`\n\n### Release Process Note\n\n`patched_versions` is pre-set to the release (`2026.2.25`).\nAdvisory published with npm release `2026.2.25`.2.25` is published, this advisory is published.\n\nOpenClaw thanks @zdi-disclosures for reporting.","status":"published","published":"2026-03-03T00:39:40Z","modified":"2026-07-08T08:13:06.837895391Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:39.618611Z"}]}}