CVE-2026-34503CWE-613

OpenClaw < 2026.3.28 - Incomplete WebSocket Session Termination on Device Removal and Token Revocation

High · published March 31, 2026

CVSS v4.0
8.6
EPSS
0%
Percentile
38.4
In the wild
Unconfirmed
What it is

OpenClaw before 2026.3.28 fails to disconnect active WebSocket sessions when devices are removed or tokens are revoked. Attackers with revoked credentials can maintain unauthorized access through existing live sessions until forced reconnection.

The record
Technical detail
CVSS v4.0
8.6 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00454 · 38.4th percentile
Weakness
CWE-613 · Insufficient Session Expiration
Published
2026-03-31T14:10Z
EPSS history
Timeline
  • 31 MAR 14:10Z
    OpenClaw < 2026.3.28 - Incomplete WebSocket Session Termination on Device Removal and Token Revocation
    cvelistv5