Executive brief
OpenClaw is a popular webhook management system used to receive and process messages from external services like Zalo. The vulnerability allows attackers to bypass rate limiting protections by making repeated incorrect authentication attempts, enabling them to brute-force (guess) valid webhook secrets without triggering account lockout or rate limit blocks. Once a secret is guessed, attackers can forge webhook messages to inject malicious traffic into systems relying on Zalo webhooks.
Technical details
OpenClaw applies rate limiting only after successful webhook authentication, not before. This creates a pre-authentication brute-force window where requests with invalid secrets receive 401 responses but do not count against rate limits (CWE-307: Improper Restriction of Excessive Authentication Attempts). An attacker can repeatedly submit authentication attempts with guessed secrets without triggering 429 (Too Many Requests) responses, significantly reducing the cost of credential brute-forcing. Once a valid secret is discovered, the attacker can construct forged Zalo webhook traffic. The vulnerability affects all versions prior to 2026.3.12, where rate limiting was moved before authentication checks. No exploitation in the wild has been reported as of publication.
Affected products
- OpenClaw OpenClaw before 2026.3.12
Timeline
- 2026-03-31: disclosed
- 2026-03-13: patched: Fixed in version 2026.3.12
- 2026-04-07: other: Advisory withdrawn - CVE-2026-34508 rejected as duplicate of CVE-2026-34505