Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenClaw versions prior to 2026.2.13 use non-constant-time string comparison for hook token validation, allowing attackers to infer tokens through timing measurements. Remote attackers with network access to the hooks endpoint can exploit timing side-channels across multiple requests to gradually recover the authentication token.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-28475 OpenClaw versions prior to 2026.2.13 use non-constant-time string comparison for hook token validation, allowing attackers to infer tokens through timing measurements… https://www.cve.org/CVERecord?id=CVE-2026-28475
Post summary
The post discloses that OpenClaw versions before 2026.2.13 use insecure token comparison, enabling timing attacks to infer hook tokens.
[CVE-2026-28475: CRITICAL] OpenClaw versions before 2026.2.13 have a cyber security vulnerability: non-constant-time string comparison. Attackers can uncover tokens via timing attacks.#cve,CVE-2026-28475,#cybersecurity https://cvefind.com/CVE-2026-28475
Post summary
The post announces a critical timing‑attack vulnerability (non‑constant‑time string comparison) in OpenClaw versions before 2026.2.13, providing technical details but no PoC, exploit, or mitigation.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | openclaw | openclaw | - | node.js | - |