GHSA-553v-f69r-656j OpenClaw unpaired device identity can bypass operator pairing and self-assign operator scopes with shared auth

• npm openclaw: >= 2026.2.22, < 2026.2.25 → fixed in 2026.2.25

Summary A client using shared gateway auth could attach an unpaired device identity and request elevated operator scopes (including `operator.admin`) before pairing approval, enabling privilege escalation. Impact Attackers with valid shared gateway auth could self-assign higher operator scopes by presenting a self-signed, unpaired device identity. Affected Packages / Versions • Package: `openclaw` (npm) • Affected: `>= 2026.2.22 = 2026.2.25`). Advisory published with npm release `2026.2.25`. OpenClaw thanks @tdjackey for reporting.