A critical authentication bypass and brute-force vulnerability in OpenClaw allows remote attackers to compromise operator sessions via malicious web pages.

The vulnerability involves a flaw in browser-origin WebSocket clients that permits unauthorized origin access and circumvents authentication throttling mechanisms. An attacker can leverage this to perform automated password brute-force attacks against the gateway, eventually establishing an authenticated operator session without legitimate credentials.

The ability for an attacker to gain an authenticated operator session poses a severe risk to organizational operations, potentially granting unauthorized access to control-plane methods. Given the CVSS score of 7.5, this high-severity flaw could lead to complete system compromise, unauthorized data access, or the manipulation of critical services, resulting in significant operational disruption and security exposure.

Immediate Action: Update the OpenClaw package to version 2026.2.25 or later to resolve the WebSocket authentication hardening gap.

Proactive Monitoring: Review web server and application access logs for unusual patterns of repeated authentication requests originating from unexpected browser origins or loopback addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) or equivalent gateway security policy to strictly validate WebSocket origins and enforce rate limiting on authentication endpoints as a temporary measure.

Public Exploit Available: No (exploit_available: unknown)

The risk posed by CVE-2026-32025 is substantial due to the potential for unauthorized administrative access to the control plane. Security teams should prioritize the deployment of the 2026.2.25 update across all affected environments immediately. In scenarios where patching cannot be performed instantly, strict enforcement of origin header validation at the network perimeter is advised to prevent the exploitation of this WebSocket-based flaw.