https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-09-30T10:03:05.148349+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-28477 CVE-2026-28477 — OpenClaw < 2026.2.14 - OAuth State Validation Bypass in Manual Chutes Login Flow 2026-09-30T10:03:05.152124+00:00

Affected: OpenClaw

OpenClaw versions prior to 2026.2.14 contain an oauth state validation bypass vulnerability in the manual Chutes login flow that allows attackers to bypass CSRF protection. An attacker can convince a user to paste attacker-controlled OAuth callback data, enabling credential substitution and token persistence for unauthorized accounts.

 https://db.gcve.eu/vuln/ghsa-7rcp-mxpq-72pj GHSA-7rcp-mxpq-72pj — OpenClaw Chutes manual OAuth state validation bypass can cause credential substitution 2026-09-30T10:03:05.152234+00:00

Affected: npm: openclaw

## Summary

The manual Chutes OAuth login flow could accept attacker-controlled callback input in a way that bypassed OAuth CSRF state validation, potentially resulting in credential substitution.

## Impact

If an attacker can convince a user to paste attacker-provided OAuth callback data during the manual login prompt, OpenClaw may exchange an attacker-obtained authorization code and persist tokens for the wrong Chutes account.

The automatic local callback flow is not affected (it validates state in the local HTTP callback handler).

## Affected Packages / Versions

- `openclaw` (npm): `<= 2026.2.13` when using the manual Chutes OAuth login flow.

## Fix

The manual flow now requires the full redirect URL (must include `code` and `state`), validates the returned `state` against the expected value, and rejects code-only pastes.

## Fix Commit(s)

- a99ad11a4107ba8eac58f54a3c1a8a0cf5686f47

Thanks @aether-ai-agent for reporting.