Authentication Bypass Vulnerability in Crabbox by OpenClaw

CVE-2026-45223

What is CVE-2026-45223?

Crabbox prior to version 0.9.0 is vulnerable to an authentication bypass that affects the user-token verification process. The vulnerability arises in the verifyUserToken() function, which improperly accepts payloads that include an admin claim. This oversight enables an attacker with access to a non-admin shared token to forge a user-token payload marked with 'admin: true'. By doing so, they can present this payload to protected admin routes, allowing them to bypass standard authentication measures. This grants unauthorized access to key functionalities such as lease visibility, pool state management, and other admin-level operations.

References