CVE-2026-62223CWE-863broken-access-control

CVE-2026-62223

High · published July 17, 2026

CVSS v3.1

8.8

EPSS

Percentile

38.2

In the wild

Unconfirmed

What it is

OpenClaw before 2026.5.18 contain an authorization bypass vulnerability in the device-pair approval feature that allows lower-trust callers to execute actions beyond their intended authorization. Attackers can exploit misconfigured input paths to execute or persist unauthorized actions when the affected feature is enabled and reachable.

The record

Technical detail

CVSS v3.1: 8.8 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.00451 · 38.2th percentile
Weakness: CWE-863 · Incorrect Authorization
Published: 2026-07-17T06:18Z

Affected products (1)

Product	Versions	Fixed in
openclaw/openclaw	< 2026.5.18	2026.5.18

References (2)

https://github.com/openclaw/openclaw/security/advisories/GHSA-hx85-fgcw-9vrc · [email protected]https://www.vulncheck.com/advisories/openclaw-authorization-bypass-via-device-pair · [email protected]

EPSS history

Timeline

17 JUL 00:07Z
OpenClaw < 2026.5.18 Authorization Bypass via Device-pair
cvelistv5