A vulnerability in the OpenClaw package for npm (versions >=2026.4.10 <2026.4.14) allowed Microsoft Teams SSO invoke handler to process invokes without proper sender authorization checks. This issue was fixed in version 2026.4.14 by routing SSO invoke handling through the Teams sender authorization path and adding coverage for denied senders. The vulnerability has a medium severity score of 6.3 CVSS 4.0 and does not have known exploits in the wild.