A critical session management flaw in OpenClaw allows authenticated users with revoked credentials to maintain unauthorized access via persistent WebSocket sessions.

This vulnerability involves insufficient session expiration (CWE-613), where the application fails to invalidate active WebSocket connections when a user token is revoked or a device is removed. An attacker who has already established a session must possess low-level privileges to exploit this flaw, as the vulnerability pertains to the persistence of existing authenticated sessions.

The inability to terminate sessions effectively creates a window of unauthorized access for users whose permissions have been revoked. This risks data exposure and unauthorized actions within the application, as the system trusts existing sessions that should have been invalidated. With a CVSS score of 8.1, this vulnerability poses a high risk to organizational security and compliance posture.

Immediate Action: Update the OpenClaw package to version 2026.3.28 or later to ensure that WebSocket sessions are correctly terminated upon token revocation.

Proactive Monitoring: Review WebSocket traffic logs for connections that remain active for unusually long durations or originate from accounts marked as disabled or revoked in the identity provider.

Compensating Controls: If an immediate update is not feasible, implement server-side logic to force-close all active WebSocket connections periodically or upon administrative triggers to flush potentially stale sessions.

Public Exploit Available: No

The risk posed by this session management flaw is significant, as it bypasses standard access control lifecycle processes. Administrators should prioritize updating to version 2026.3.28 immediately to restore the integrity of session termination. Failure to apply this patch leaves the system vulnerable to persistent unauthorized access by users who should no longer have operational privileges.