Executive brief
A security vulnerability exists in DroidClaw, an AI agent platform used to automate Android phones. An attacker can exploit a flaw in how the system handles scheduled tasks to hijack another user's connected device. This could allow an unauthorized person to remotely control a victim's phone, potentially accessing sensitive settings or performing actions as if they were the device owner.
Technical details
An authorization bypass exists in the `POST /goals/execute` route within `server/src/routes/goals.ts`. The application fails to verify that the `deviceId` and `userId` provided in a callback request match the original owner of the `sessionId`. When the `QSTASH_CURRENT_SIGNING_KEY` environment variable is unset or empty, the server accepts unsigned JSON payloads. An attacker with a valid `sessionId` can forge a callback request with a victim's `deviceId`, causing the server to deliver commands (such as `open_settings`) to the victim's WebSocket connection instead of the attacker's. This allows for cross-user device command injection. As of the advisory date, the project has not released a patch.
Affected products
- unitedbyai droidclaw up to 0.5.3
Timeline
- 2026-07-27: disclosed: Vulnerability reported via GitHub issue and VulDB
- 2026-07-27: advisory