CVE-2026-53862CWE-266CWE-345

OpenClaw < 2026.5.12 - Bootstrap Token Replay via Pending Pairing Scope Widening

Low · published June 16, 2026

CVSS v4.0
2.3
EPSS
0%
Percentile
2.3
In the wild
Unconfirmed
What it is

OpenClaw before 2026.5.12 contains a bootstrap token replay vulnerability allowing callers with pending token access to reuse tokens with broader requested scopes. Attackers can replay bootstrap tokens before approval to escalate pairing authority beyond intended scope limits.

The record
Technical detail
CVSS v4.0
2.3 · LOW
Vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00129 · 2.3th percentile
Weaknesses
CWE-266 · Incorrect Privilege Assignment; CWE-345 · Insufficient Verification of Data Authenticity
Published
2026-06-16T18:05Z
EPSS history
Timeline
  • 16 JUN 18:05Z
    OpenClaw < 2026.5.12 - Bootstrap Token Replay via Pending Pairing Scope Widening
    cvelistv5