Openclaw cli: OpenClaw: Gemini OAuth exposed the PKCE verifier through the OAuth state parameter (CVE-2026-34511)
Description
OpenClaw CLI versions up to 2026.4.1 have a vulnerability in the Gemini OAuth flow where the PKCE verifier is reused as the OAuth state parameter. This causes the verifier to be exposed in the redirect URL alongside the authorization code. An attacker who can capture the redirect URL could obtain both values, defeating the PKCE protection and enabling token redemption. The issue is fixed in version 2026.4.2 by separating the OAuth state from the PKCE verifier.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Before OpenClaw version 2026.4.2, the Gemini OAuth flow reused the PKCE verifier as the OAuth 'state' parameter. Since the OAuth provider reflects the 'state' parameter back in the redirect URL, this caused the PKCE verifier to be exposed alongside the authorization code. This exposure allows an attacker who can capture the redirect URL to obtain both the authorization code and the PKCE verifier, effectively defeating the interception protection provided by PKCE and enabling token redemption. The vulnerability affects OpenClaw CLI versions from 2026.1.29 up to but not including 2026.4.2. The issue was fixed in commit a26f4d0f3ef0757db6c6c40277cc06a5de76c52f by separating the OAuth state from the PKCE verifier.
Potential Impact
An attacker capable of capturing the OAuth redirect URL can obtain both the authorization code and the PKCE verifier. This breaks the security guarantees of PKCE, allowing the attacker to redeem the authorization code for tokens, potentially leading to unauthorized access. The vulnerability compromises the OAuth flow's interception resistance.
Mitigation Recommendations
A patch is available in OpenClaw version 2026.4.2 and later, which separates the OAuth state parameter from the PKCE verifier. Users should upgrade to version 2026.4.2 or newer to remediate this vulnerability. No additional mitigation steps are indicated by the vendor advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BREW-openclaw-cli-CVE-2026-34511
- Osv Schema Version
- 1.7.3
- Ecosystems
- ["Homebrew"]
- Cvss Version
- 4.0
Threat ID: 6ac245b012601ec6a3166b1b
Added to database: 10/04/2026, 12:25:20 UTC
Last enriched: 10/04/2026, 12:57:06 UTC
Last updated: 10/04/2026, 16:08:37 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.