CVE-2026-10216
unitedbyai droidclaw claim Endpoint pairing.ts excessive authentication
CVSS Score
3.7
EPSS Score
0.1%
EPSS Percentile
18th
A vulnerability was detected in unitedbyai droidclaw up to 0.5.3. The affected element is an unknown function of the file server/src/routes/pairing.ts of the component claim Endpoint. The manipulation results in improper restriction of excessive authentication attempts. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is described as difficult. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
| CWE | CWE-307 CWE-799 |
| Vendor | unitedbyai |
| Product | droidclaw |
| Published | Jun 1, 2026 |
| Last Updated | Jun 1, 2026 |
Stay Ahead of the Next One
Get instant alerts for unitedbyai droidclaw
Be the first to know when new low vulnerabilities affecting unitedbyai droidclaw are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
unitedbyai / droidclaw
0.5.0 0.5.1 0.5.2 0.5.3
References
vuldb.com: https://vuldb.com/vuln/367495 vuldb.com: https://vuldb.com/vuln/367495/cti vuldb.com: https://vuldb.com/cve/CVE-2026-10216 vuldb.com: https://vuldb.com/submit/821936 github.com: https://github.com/unitedbyai/droidclaw/issues/14 gist.github.com: https://gist.github.com/YLChen-007/2639ccaefd55ef4309953b76bc4c737e/raw github.com: https://github.com/unitedbyai/droidclaw/
Credits
🔍 Eric-b (VulDB User) VulDB CNA Team