Executive brief
OpenClaw is a JavaScript library for managing webhooks. The hooks authentication mechanism uses a standard string comparison for token validation, which is vulnerable to timing attacks. An attacker with network access to the hooks endpoint could measure response times across many requests to gradually infer the authentication token, potentially allowing unauthorized access to webhook functionality.
Technical details
The vulnerability is a non-constant-time comparison flaw (CWE-208) in the hooks authentication token verification logic. OpenClaw's hooks endpoint previously used a regular string comparison operator instead of a constant-time comparison function to validate authentication tokens. An attacker with network access to an exposed hooks endpoint can perform timing analysis across many requests to infer the token byte-by-byte. The attack requires the hooks endpoint to be accessible over an untrusted network and a high number of requests; real-world network jitter and latency make successful exploitation difficult in practice. The fix, implemented in commit 113ebfd and released in version 2026.2.12, upgrades the comparison to use a constant-time algorithm. Mitigation options include restricting network access to the hooks endpoint and rotating tokens after updating.
Affected products
- OpenClaw OpenClaw < 2026.2.12
Timeline
- 2026-03-02: disclosed: Advisory published
- 2026-02-12: patched: Fixed in version 2026.2.12