Executive brief
OpenClaw's Synology Chat webhook integration fails to throttle repeated failed authentication attempts when validating webhook tokens. This allows an attacker to rapidly guess weak webhook secrets without being rate-limited, gaining unauthorized access to trigger webhook actions. Exploitation requires no authentication and can be performed remotely, potentially exposing sensitive chat operations or enabling automated attacks on webhook-dependent workflows.
Technical details
The vulnerability is a pre-authentication rate-limit bypass in OpenClaw's webhook token validation logic (CWE-307: Improper Restriction of Excessive Authentication Attempts). Invalid webhook tokens are rejected without implementing throttling or lockout mechanisms on repeated failed guesses, allowing attackers to perform brute-force attacks against weak secrets. The attack is network-accessible, requires no prior authentication or user interaction, and succeeds by making successive requests with different token guesses until a valid webhook token is discovered. An attacker who guesses a valid webhook token can then trigger webhook actions with the privileges of that token. The vulnerability was fixed in version 2026.3.25 (commit 0b4d07337467f4d40a0cc1ced83d45ceaec0863c), which adds throttling logic and lockout enforcement after repeated token failures.
Affected products
- OpenClaw openclaw < 2026.3.25
Timeline
- 2026-03-26: disclosed: Advisory published for GHSA-mf5g-6r6f-ghhm (primary advisory)
- 2026-03-26: patched: Fix commit 0b4d07337467f4d40a0cc1ced83d45ceaec0863c merged; version 2026.3.25 planned release
- 2026-04-10: advisory: Duplicate advisory GHSA-59xc-5v89-r7pr published and then withdrawn on same day