Executive brief
OpenClaw is a Microsoft Teams integration library that handles single sign-on (SSO) and message processing. A vulnerability allowed operators with restrictive access policies to bypass sender authorization checks during SSO token exchange, enabling blocked or unauthorized users to exchange and store delegated authentication tokens. This could lead to unauthorized access or token misuse if an attacker compromises a blocked user's identity.
Technical details
The vulnerability is an authorization bypass (CWE-862) in the SSO invoke handler (`signin/tokenExchange` and `signin/verifyState` endpoints) in OpenClaw's Microsoft Teams extension. Unlike other invoke handlers in the same codebase (feedback, adaptive card, file consent), the SSO handler failed to call `resolveMSTeamsSenderAccess()`, missing three authorization layers: DM policy, channel/team allowlist, and group sender allowlist checks. An attacker could send an SSO invoke from a blocked sender to exchange and persist a delegated token in `msteams-sso-tokens.json`. The attack is network-reachable and requires no user interaction. The fix (PR #66033, commit 80b1fa1) routes SSO handling through the standard sender authorization path via a new `isSigninInvokeAuthorized()` guard. Patched in version 2026.4.14.
Affected products
- OpenClaw openclaw 2026.4.10 to 2026.4.13
Timeline
- 2026-04-17: disclosed
- 2026-04-14: patched: Fixed in version 2026.4.14