Executive brief
OpenClaw is a library that includes support for BlueBubbles webhooks. A security flaw in the webhook authentication process allows attackers to repeatedly guess passwords without being slowed down or blocked. This could lead to unauthorized access to the webhook, potentially exposing private messaging data or allowing unauthorized actions.
Technical details
The BlueBubbles webhook authentication mechanism in OpenClaw (versions <= 2026.3.24) fails to implement rate limiting or throttling for failed login attempts. This vulnerability (CWE-307) allows a remote attacker to perform a brute-force attack against the webhook password over the network. If successful, the attacker can bypass authentication to interact with the webhook. The issue is particularly severe when weak passwords (CWE-521) are used. A fix was introduced in version 2026.3.25 which implements repeated-guess throttling before returning authentication failure responses.
Affected products
- OpenClaw openclaw <= 2026.3.24
Timeline
- 2026-03-26: disclosed: Initial disclosure by reporter zpbrent
- 2026-03-27: advisory: GitHub Advisory GHSA-xq8g-hgh6-87hv published
- 2026-03-25: patched: Fix commit 5e08ce3 pushed to main branch