Executive brief
OpenClaw is a popular Node.js package that provides authentication capabilities including OAuth flows. The Gemini OAuth implementation reused the PKCE verifier as the OAuth state parameter, causing it to be exposed in redirect URLs. An attacker who captures a user's redirect URL could obtain both the authorization code and PKCE verifier, allowing them to hijack OAuth sessions and gain unauthorized access to user accounts.
Technical details
The vulnerability is an insecure random number generation and cryptographic material exposure issue (CWE-330) in OpenClaw's Gemini OAuth flow. The root cause is that the PKCE verifier—a cryptographic secret intended to protect against authorization code interception—was reused as the OAuth state parameter. Since OAuth providers reflect the state value back in the redirect URL, this exposed the PKCE verifier alongside the authorization code in plaintext. An attacker with network access to intercept or log redirect URLs could capture both secrets, defeating PKCE's interception protection and enabling token redemption. The vulnerability affects all versions up to 2026.4.1 and is fixed in 2026.4.2, where state and PKCE verifier are now properly separated.
Affected products
- OpenClaw openclaw <= 2026.4.1
Timeline
- 2026-04-02: disclosed
- 2026-04-02: patched: Fix commit a26f4d0f3ef0757db6c6c40277cc06a5de76c52f separates OAuth state from PKCE verifier
- 2026-04-03: advisory: GHSA-9jpj-g8vv-j5mf published; GHSA-ch86-pxr9-j9h9 is a duplicate