Executive brief
OpenClaw is a messaging and webhook automation library used by developers to integrate message routing and authentication. The BlueBubbles webhook authentication endpoint lacks rate limiting on failed password attempts, allowing attackers to repeatedly guess weak passwords without throttling or account lockouts. This vulnerability enables brute-force attacks that could compromise webhook authentication and lead to unauthorized access to messaging systems.
Technical details
This vulnerability is a missing rate limiting issue (CWE-307) in the BlueBubbles webhook authentication mechanism. The webhook endpoint rejects incorrect password guesses without implementing throttling, allowing attackers to submit unlimited authentication attempts against weak passwords from a remote network. No authentication or special preconditions are required; an attacker needs only network access to the webhook endpoint. Successful exploitation allows an attacker to brute-force the webhook password and gain unauthorized access. The fix (commit 5e08ce36d522a1c96df2bfe88e39303ae2643d92) adds repeated-guess throttling before auth failure responses, and was released in version 2026.3.25.
Affected products
- OpenClaw openclaw <= 2026.3.24
Timeline
- 2026-03-26: disclosed
- 2026-04-10: advisory
- 2026-03-25: patched: Version 2026.3.25 includes fix via commit 5e08ce36d522a1c96df2bfe88e39303ae2643d92