An unauthenticated device identity check bypass vulnerability in OpenClaw allows remote attackers to compromise critical system functions.

This vulnerability (CWE-306) occurs because the application fails to perform necessary authentication during the gateway websocket handshake process, allowing unauthenticated remote attackers to bypass identity verification.

Successful exploitation allows an unauthenticated attacker to interact with sensitive gateway functions, potentially leading to unauthorized system access or control. Given the CVSS score of 8.1, this represents a high-severity risk that could result in significant operational disruption and data integrity loss.

Immediate Action: Update the OpenClaw package to version 2026.2.2 or later to apply the necessary authentication checks.

Proactive Monitoring: Monitor websocket traffic for unexpected connection patterns or unauthorized handshake attempts originating from untrusted sources.

Compensating Controls: Deploy a Web Application Firewall (WAF) or API gateway to filter and validate incoming websocket traffic, blocking requests that do not adhere to expected authentication protocols.

Public Exploit Available: Unknown.

The severity of this flaw necessitates immediate attention. Organizations utilizing OpenClaw must prioritize updating to version 2026.2.2 to close the authentication gap and prevent unauthorized access to the gateway infrastructure.