CVE-2026-45223 describes an authentication bypass vulnerability in openclaw's Crabbox product prior to version 0.9.0. The issue lies in the coordinator's user-token verification path, where the verifyUserToken() function fails to reject payloads containing an admin claim. An attacker possessing a shared non-admin token can craft a user-token payload with admin: true, sign it using HMAC-SHA256, and gain unauthorized full admin access to coordinator routes. This allows escalation of privileges including lease visibility, pool state management, and forced release operations. The vulnerability is rated with a CVSS 4.0 score of 7.7 (high severity). No patch or official remediation level has been provided by the vendor as of the published date.

An attacker with access to a shared non-admin token can escalate privileges to full coordinator admin by exploiting the token verification flaw. This grants unauthorized administrative capabilities such as viewing leases, managing pool states, and forcing release operations, potentially compromising system integrity and control.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to shared tokens and monitor for suspicious token usage. Avoid using versions prior to 0.9.0 where this vulnerability exists.