Threats tagged 'ghsa-rfqg-qgf8-xr9x'

The OpenClaw package versions up to 2026.3.28 have a vulnerability where the gateway's device token rotation function does not terminate active WebSocket sessions after credentials are rotated. This creates a post-compromise revocation gap, allowing already-authenticated WebSocket sessions to remain active despite token rotation. The issue is classified as medium severity with a CVSS score of 5.4. A fix is available in version 2026.3.31 and later.