GitHub Advisoryadvisory · npm

GHSA-p464-m8x6-vhv8 OpenClaw: MS Teams webhook parses body before JWT validation, enabling unauthenticated resource exhaustion

HIGH Published 2026-04-03 Modified 2026-05-06 Official page ↗
Aliases
CVE-2026-41405
Ecosystem
npm
Packages
openclaw
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400, CWE-408
Reviewed
2026-04-03

Affected packages

• npm openclaw: < 2026.3.31 → fixed in 2026.3.31

Description

Summary MS Teams webhook parses body before JWT validation, enabling unauthenticated resource exhaustion Current Maintainer Triage • Status: open • Normalized severity: medium • Assessment: v2026.3.28 still parses Teams JSON after only a Bearer-prefix gate and before real JWT validation, and the auth-before-parse fix is not yet shipped. Affected Packages / Versions • Package: `openclaw` (npm) • Latest published npm version: `2026.3.31` • Vulnerable version range: `= 2026.3.31` • First stable tag containing the fix: `v2026.3.31` Fix Commit(s) • `3834d47099dd13c8244ed6de8b9ea9855c553623` — 2026-03-30T13:46:40+01:00 OpenClaw thanks @AntAISecurityLab for reporting.

Related

Alias · CVE (1)

  • CVE-2026-41405 OpenClaw before 2026.3.31 parses MS Teams webhook request bodies before performing JWT validation, allowing unauthenticated attackers to… vulnerability

Weakness · CWE (2)

  • CWE-400 Uncontrolled Resource Consumption weakness
  • CWE-408 Incorrect Behavior Order: Early Amplification weakness

References