GitHub Advisoryadvisory · npm

GHSA-5m9r-p9g7-679c OpenClaw: Zalo webhook rate limiting could be bypassed before secret validation

MEDIUM Published 2026-03-13 Modified 2026-04-06 Official page ↗
Aliases
CVE-2026-34505
Ecosystem
npm
Packages
openclaw
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Weaknesses
CWE-307
Reviewed
2026-03-13

Affected packages

• npm openclaw: < 2026.3.12 → fixed in 2026.3.12

Description

Summary The Zalo webhook handler applied request rate limiting only after webhook authentication succeeded. Requests with an invalid secret returned `401` but did not count against the rate limiter, allowing repeated secret guesses without triggering `429`. Impact This made brute-force guessing materially easier for weak but policy-compliant webhook secrets. Once the secret was guessed, an attacker could submit forged Zalo webhook traffic. Affected versions `openclaw` `<= 2026.3.11` Patch Fixed in `openclaw` `2026.3.12`. Rate limiting now applies before successful authentication is required, closing the pre-auth brute-force gap. Users should update to `2026.3.12` or later and prefer strong webhook secrets.

Related

Alias · CVE (1)

  • CVE-2026-34505 OpenClaw before 2026.3.12 applies rate limiting only after successful webhook authentication, allowing attackers to bypass rate limits and… vulnerability

Weakness · CWE (1)

  • CWE-307 Improper Restriction of Excessive Authentication Attempts weakness

References