Duplicate Advisory: Bootstrap token replay could widen pending pairing scopes

GHSA-h9h6-pwqv-j9hv

Published Jun 16, 2026 · Modified Jun 18, 2026

Description

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-9v8j-9c9g-w66c. This link is maintained to preserve external references.

Original Description

OpenClaw before 2026.5.12 contains a bootstrap token replay vulnerability allowing callers with pending token access to reuse tokens with broader requested scopes. Attackers can replay bootstrap tokens before approval to escalate pairing authority beyond intended scope limits.

References

WEB https://github.com/openclaw/openclaw/security/advisories/GHSA-9v8j-9c9g-w66c
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-53862
PACKAGE https://github.com/openclaw/openclaw
WEB https://www.vulncheck.com/advisories/openclaw-bootstrap-token-replay-via-pending-pairing-scope-widening

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes