CVE-2026-34511CWE-330

OpenClaw < 2026.4.2 - PKCE Verifier Exposure via OAuth State Parameter

Medium · published April 3, 2026

CVSS v4.0
6.0
EPSS
0%
Percentile
35.9
In the wild
Unconfirmed
What it is

OpenClaw before 2026.4.2 reuses the PKCE verifier as the OAuth state parameter in the Gemini OAuth flow, exposing it through the redirect URL. Attackers who capture the redirect URL can obtain both the authorization code and PKCE verifier, defeating PKCE protection and enabling token redemption.

The record
Technical detail
CVSS v4.0
6.0 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00427 · 35.9th percentile
Weakness
CWE-330 · Use of Insufficiently Random Values
Published
2026-04-03T20:45Z
EPSS history
Timeline
  • 03 APR 20:45Z
    OpenClaw < 2026.4.2 - PKCE Verifier Exposure via OAuth State Parameter
    cvelistv5