Executive brief
OpenClaw, a library used for integrating with services like Synology Chat, contains a security flaw in how it handles webhook authentication. The system fails to limit the speed of failed login attempts, which could allow an attacker to repeatedly guess security tokens until they gain unauthorized access. This could lead to unauthorized message injection or data exposure within connected chat services.
Technical details
A vulnerability classified as CWE-307 (Improper Restriction of Excessive Authentication Attempts) exists in OpenClaw's Synology Chat webhook integration. The component rejected invalid tokens without implementing any throttling or lockout mechanisms for repeated failed attempts. A remote, unauthenticated attacker can exploit this by sending rapid successive requests to guess weak webhook secrets. Successful exploitation allows the attacker to bypass authentication and interact with the webhook as a legitimate source. The issue is addressed in version 2026.3.25 by adding repeated-guess throttling and lockout enforcement.
Affected products
- OpenClaw openclaw <= 2026.3.24
Timeline
- 2026-03-26: patched: Fix committed and advisory GHSA-mf5g-6r6f-ghhm published.
- 2026-04-09: advisory: NVD published CVE-2026-35646.
- 2026-04-10: advisory: Duplicate advisory GHSA-59xc-5v89-r7pr published and subsequently withdrawn.