{"affected":[{"conditional":false,"product":"openclaw","source":"NVD","vendor":"openclaw","versions":[{"lessThan":"2026.3.31","status":"affected","version":"*","versionType":"custom"}]},{"defaultStatus":"unaffected","ecosystem":"npm","packageName":"openclaw","product":"openclaw","source":"OSV GHSA-6p8r-6m93-557f","vendor":"","versions":[{"events":[{"introduced":"0"},{"fixed":"2026.3.31"}],"lessThan":"2026.3.31","status":"affected","version":"0","versionType":"semver"}]}],"cpeConfigurations":[{"negate":false,"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","versionEndExcluding":"2026.3.31","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"}],"cveId":"CVE-2026-41333","cwes":["CWE-799"],"description":"OpenClaw before 2026.3.31 contains an authentication rate limiting bypass vulnerability that allows attackers to circumvent shared authentication protections using fake device tokens. Attackers can exploit the mixed WebSocket authentication flow to bypass rate limiting controls and conduct brute force attacks against weak shared passwords.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":6.3,"severity":"medium","source":"NVD: disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0"},{"score":3.7,"severity":"low","source":"NVD: disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"}],"modifiedAt":1794438600263,"publishedAt":1776982599083,"references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/af0c0862f22ca4492406a3103d05e3628f94cbe9"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-6p8r-6m93-557f"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-authentication-rate-limiting-bypass-via-fake-devicetoken"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-6p8r-6m93-557f"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-6p8r-6m93-557f"}],"remediation":[{"kind":"fix","source":"disclosure@vulncheck.com","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/openclaw/openclaw/commit/af0c0862f22ca4492406a3103d05e3628f94cbe9"},{"kind":"fix","source":"OSV GHSA-6p8r-6m93-557f","text":"openclaw (npm): OSV reports a fixed version 2026.3.31. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-6p8r-6m93-557f"}],"revision":"b7c7a7ee19833931487fc8835243abd63f3a38ae75bcdc0b7efe88dd5dcb2cb1","sources":[{"modifiedAt":1794438600263,"name":"NVD","retrievedAt":1794442758847,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41333"},{"modifiedAt":1778110888856,"name":"OSV / GitHub Security Advisories","retrievedAt":1794442759602,"url":"https://osv.dev/vulnerability/GHSA-6p8r-6m93-557f"}],"ssvc":{"assessedAt":1777037725571,"automatable":"no","exploitation":"none","source":"NVD SSVC: 134c704f-9b21-4f2e-91b3-4a467353bcc0","technicalImpact":"partial"},"status":"published","title":"CVE-2026-41333","updatedAt":1794442759602}