CVE-2026-28480CWE-290

OpenClaw < 2026.2.14 - Identity Spoofing via Mutable Username in Telegram Allowlist Authorization

Medium · published March 5, 2026

CVSS v4.0
6.9
EPSS
0%
Percentile
31.5
In the wild
Unconfirmed
What it is

OpenClaw versions prior to 2026.2.14 contain an authorization bypass vulnerability where Telegram allowlist matching accepts mutable usernames instead of immutable numeric sender IDs. Attackers can spoof identity by obtaining recycled usernames to bypass allowlist restrictions and interact with bots as unauthorized senders.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00387 · 31.5th percentile
Weakness
CWE-290 · Authentication Bypass by Spoofing
Published
2026-03-05T21:59Z
EPSS history
Timeline
  • 05 MAR 21:59Z
    OpenClaw < 2026.2.14 - Identity Spoofing via Mutable Username in Telegram Allowlist Authorization
    cvelistv5