GitHub Advisoryadvisory · npm

GHSA-9jpj-g8vv-j5mf OpenClaw: Gemini OAuth exposed the PKCE verifier through the OAuth state parameter

HIGH Published 2026-04-04 Modified 2026-04-07 Official page ↗
Aliases
CVE-2026-34511
Ecosystem
npm
Packages
openclaw
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N
Weaknesses
CWE-345
Reviewed
2026-04-04

Affected packages

• npm openclaw: < 2026.4.2 → fixed in 2026.4.2

Description

Summary Before OpenClaw 2026.4.2, the Gemini OAuth flow reused the PKCE verifier as the OAuth `state` value. Because the provider reflected `state` back in the redirect URL, the verifier could be exposed alongside the authorization code. Impact Anyone who could capture the redirect URL could learn both the authorization code and the PKCE verifier, defeating PKCE's interception protection for that flow and enabling token redemption. Affected Packages / Versions • Package: `openclaw` (npm) • Affected versions: `= 2026.4.2` • Latest published npm version: `2026.4.1` Fix Commit(s) • `a26f4d0f3ef0757db6c6c40277cc06a5de76c52f` — separate OAuth state from the PKCE verifier OpenClaw thanks @BG0ECV for reporting.

Related

Alias · CVE (1)

  • CVE-2026-34511 OpenClaw before 2026.4.2 reuses the PKCE verifier as the OAuth state parameter in the Gemini OAuth flow, exposing it through the redirect… vulnerability

Weakness · CWE (1)

  • CWE-345 Insufficient Verification of Data Authenticity weakness

References