CVE-2026-45223 is an authentication bypass vulnerability in openclaw's crabbox product prior to version 0.9.0. The flaw exists in the coordinator's user-token verification path, where the verifyUserToken() function fails to reject payloads containing an admin claim. An attacker possessing a shared non-admin token can craft a user-token payload with admin: true, sign it using HMAC-SHA256, and gain unauthorized full admin access to coordinator routes. This includes capabilities such as viewing leases, managing pool states, and forcing release operations. The vulnerability is rated high severity with a CVSS 4.0 score of 7.7. No patch or official remediation has been disclosed.

Exploitation of this vulnerability allows an attacker with access to a shared non-admin token to escalate privileges to full coordinator admin rights. This grants unauthorized access to sensitive coordinator functions including lease visibility, pool state management, and forced release operations, potentially compromising system integrity and control.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to shared non-admin tokens and monitor for suspicious token usage. Avoid using vulnerable versions of crabbox in sensitive environments where privilege escalation risk is unacceptable.