# OpenClaw authorization bypass via pairing-scoped device session

Source: https://junglewise.ai/threats/openclaw-authorization-bypass-via-pairing-scoped-device-session-6eb9e5ad  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-16. Updated: 2026-06-18  
License: CC BY 4.0 with a link back

Severity: high · CVSS 8.8 · Published 2026-06-16

OpenClaw, an open-source communication library, contains a flaw that allows previously authorized devices to maintain access even after their permissions have been revoked. An attacker with an existing paired device can bypass security controls to regain full access to the system's communication channels without needing new approval from an administrator. This undermines the ability of operators to effectively kick unauthorized or compromised devices off the network.

Technologies: [Openclaw](https://junglewise.ai/threats/technologies/openclaw). Vendors: [Openclaw](https://junglewise.ai/threats/vendors/openclaw).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** High severity, with a CVSS score of 8.8, published 16 June 2026.

**Which products and versions are affected?** Openclaw < 2026.5.26.

**Is there a fix for This vulnerability?** A patch was published on 2026-06-18: Duplicate advisory withdrawn and patch confirmed in 2026.5.26 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run Openclaw at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

OpenClaw before version 2026.5.26 is vulnerable to an authorization bypass (CWE-613/CWE-863) due to insufficient session expiration. When a node token is revoked, the system fails to invalidate associated pairing-scoped device sessions. An attacker with a previously paired device can leverage these surviving sessions to re-authenticate and regain WebSocket node-level access without renewed administrative approval. This allows for persistent unauthorized access and bypasses intended device-role containment. The issue is resolved in version 2026.5.26; as a manual mitigation for older versions, administrators should restart the gateway and manually re-pair devices.

## Affected products

- OpenClaw openclaw < 2026.5.26

## Timeline

- 2026-05-28: advisory: Original advisory GHSA-q99w-vh6v-q3v7 published
- 2026-06-16: disclosed: CVE-2026-53843 published to NVD
- 2026-06-18: patched: Duplicate advisory withdrawn and patch confirmed in 2026.5.26

## References

- [https://github.com/openclaw/openclaw/security/advisories/GHSA-q99w-vh6v-q3v7](https://github.com/openclaw/openclaw/security/advisories/GHSA-q99w-vh6v-q3v7)
- [https://www.vulncheck.com/advisories/openclaw-node-token-revocation-bypass-via-pairing-scoped-device-session](https://www.vulncheck.com/advisories/openclaw-node-token-revocation-bypass-via-pairing-scoped-device-session)

## Related threats

- [OpenClaw incorrect authorization in mcp.app.view method](https://junglewise.ai/threats/cve-2026-102807-openclaw-before-2026-9-4-contains-an-incorrect-authorization)
- [OpenClaw incorrect authorization in Gateway media root allowlist](https://junglewise.ai/threats/cve-2026-102806-openclaw-before-2026-9-5-contains-an-incorrect-authorization)
- [OpenClaw exec approval bypass in Google Meet node commands](https://junglewise.ai/threats/cve-2026-100599-openclaw-versions-2026-5-1-through-2026-7-0-fail-to-apply-the)
- [OpenClaw Signal approval reaction binding logic error](https://junglewise.ai/threats/cve-2026-100598-openclaw-npm-package-openclaw-before-2026-7-1-incorrectly-binds)
- [OpenClaw time-of-check time-of-use race condition in filesystem operations](https://junglewise.ai/threats/cve-2026-100597-openclaw-npm-package-openclaw-before-2026-7-1-is-vulnerable-to-a)