CVE-2026-100532

HIGH 8.1

openclaw WhatsApp before 2026.8.1 Authentication Bypass

CVSS Score

8.1

EPSS Score

0.0%

EPSS Percentile

0th

@openclaw/whatsapp (npm) before 2026.8.1 exposes the WhatsApp login tool through the generic channel-tool path without preserving the originating sender's owner status, so the owner-only tool boundary is not enforced. An admitted non-owner sender able to steer the tool can request a forced login and receive a new QR code for a configured account, disconnecting the Gateway's WhatsApp account and causing loss of availability; full account relinking additionally requires the attacker to scan the returned QR code with another phone. The issue affects the owner-only tool boundary rather than WhatsApp transport authentication. Fixed in 2026.8.1.

CWE	CWE-862
Vendor	openclaw
Product	whatsapp
Published	Sep 26, 2026

Stay Ahead of the Next One

Get instant alerts for openclaw whatsapp

Be the first to know when new high vulnerabilities affecting openclaw whatsapp are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Affected Versions

openclaw / whatsapp

0 < 2026.8.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/openclaw/openclaw/security/advisories/GHSA-9m4p-cqp4-jppq vulncheck.com: https://www.vulncheck.com/advisories/openclaw-whatsapp-before-2026.8.1-authentication-bypass