CVE-2026-3691CWE-200

OpenClaw Client PKCE Verifier Information Disclosure Vulnerability

Medium · published April 11, 2026

CVSS v3.0
5.3
EPSS
0%
Percentile
34.3
In the wild
Unconfirmed
What it is

OpenClaw Client PKCE Verifier Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose stored credentials on affected installations of OpenClaw. User interaction is required to exploit this vulnerability in that the target must initiate an OAuth authorization flow.

The specific flaw exists within the implementation of OAuth authorization. The issue results from the exposure of sensitive data in the authorization URL query string. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-29381.

The record
Technical detail
CVSS v3.0
5.3 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00412 · 34.3th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2026-04-11T00:17Z
EPSS history
Timeline
  • 11 APR 00:17Z
    OpenClaw Client PKCE Verifier Information Disclosure Vulnerability
    cvelistv5