Threats tagged 'ghsa-jj6q-rrrf-h66h'

OpenClaw versions up to 2026.4.1 contain a low-severity timing side channel vulnerability in shared-secret comparison call sites. These call sites used early length-mismatch checks instead of a constant-time shared fixed-length comparison helper, allowing secret-length information to be leaked via timing differences. The issue does not directly lead to authentication bypass but weakens the intended constant-time secret comparison. The vulnerability is fixed in OpenClaw version 2026.4.2.