CVE-2026-53824CWE-613

Mattermost plugin for OpenClaw < 2026.4.24 - Slash Token Revocation Lag via Monitor Refresh Delay

Medium · published June 12, 2026

CVSS v4.0
6.0
EPSS
0%
Percentile
23.2
In the wild
Unconfirmed
What it is

OpenClaw before 2026.4.24 contains a token revocation vulnerability allowing callers with revoked slash tokens to continue executing commands during monitor refresh windows. Attackers can exploit stale token acceptance to invoke slash command behavior briefly after token revocation, potentially executing unauthorized actions depending on operator configuration.

The record
Technical detail
CVSS v4.0
6.0 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00315 · 23.2th percentile
Weakness
CWE-613 · Insufficient Session Expiration
Published
2026-06-12T21:56Z
EPSS history
Timeline
  • 12 JUN 21:56Z
    Mattermost plugin for OpenClaw < 2026.4.24 - Slash Token Revocation Lag via Monitor Refresh Delay
    cvelistv5