Executive brief
OpenClaw Gateway is a component that manages device authentication and access control. When device credentials are rotated for security purposes, the system fails to disconnect existing WebSocket sessions that were authenticated with the old credentials, allowing attackers who previously compromised those credentials to maintain unauthorized access through existing connections even after token rotation.
Technical details
The vulnerability is a session termination bypass (CWE-613: Insufficient Session Expiration) in the `device.token.rotate` endpoint. When rotating device tokens, OpenClaw Gateway does not terminate active WebSocket connections authenticated with the previous credentials, allowing post-compromise persistence. An authenticated attacker who obtained credentials before rotation can maintain access through existing WebSocket connections without re-authentication. The issue affects versions up to 2026.3.28 and is fixed in 2026.3.31; the fix terminates WebSocket sessions upon token rotation.
Affected products
- OpenClaw Gateway <=2026.3.28
Timeline
- 2026-03-31: disclosed
- 2026-03-31: patched: Version 2026.3.31 released with fix