CVE-2026-3691 OpenClaw Client PKCE Verifier Information Disclosure Vulnerability
Remote attackers can disclose stored credentials by exploiting OAuth implementation flaws in OpenClaw, requiring user interaction to initiate the flow.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-3691?
CVE-2026-3691 is a medium-severity vulnerability in Openclaw Openclaw, published on 11 Apr 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
OpenClaw Client PKCE Verifier Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose stored credentials on affected installations of OpenClaw. User interaction is required to exploit this vulnerability in that the target must initiate an OAuth authorization flow.
The specific flaw exists within the implementation of OAuth authorization. The issue results from the exposure of sensitive data in the authorization URL query string. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-29381.
Weakness: CWE-200
Which versions are affected by CVE-2026-3691?
2 open source packages ship an affected version, including openclaw. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
openclaw npm | All versions | 2026.2.25 |
openclaw npm | All versions | 2026.2.25 |
Products include Openclaw Openclaw.
How do I fix CVE-2026-3691?
Upgrade openclaw to 2026.2.25 or later.
Is CVE-2026-3691 being exploited?
There is no known exploitation of CVE-2026-3691 in the wild and no public exploit code.
Other vulnerabilities in Openclaw Openclaw
- CVE-2026-28363 Security feature bypass in OpenClaw
- CVE-2026-30741 Code injection in n/a
- CVE-2026-33579 OpenClaw < 2026.3.28 - Privilege Escalation via Missing Caller Scope Validation in Device Pair Approval
- CVE-2026-32922 OpenClaw < 2026.3.11 - Privilege Escalation via Unvalidated Scope in device.token.rotate
- CVE-2026-32978 OpenClaw < 2026.3.11 - Approval Bypass via Unrecognized Script Runners
Sources
Also known as GHSA-4h5x-fjp7-jhq3, GHSA-6g25-pc82-vfwp, MINI-gc9v-g8m8-g7wf, MINI-h3fx-7vf2-6852.