Authentication Rate Limiting Bypass in OpenClaw by OpenClaw

CVE-2026-41333

What is CVE-2026-41333?

OpenClaw prior to version 2026.3.31 is susceptible to a vulnerability enabling attackers to bypass authentication rate limiting controls. By leveraging fake device tokens within a mixed WebSocket authentication flow, attackers can exploit this weakness to conduct brute force attacks against weak shared passwords, compromising the security of user accounts. This vulnerability highlights the necessity for robust authentication mechanisms to prevent unauthorized access.

References