{"id":"EUVD-2026-18849","enisaUuid":"7f67d894-faee-3c08-821b-38cfd980bf0b","description":"OpenClaw before 2026.4.2 reuses the PKCE verifier as the OAuth state parameter in the Gemini OAuth flow, exposing it through the redirect URL. Attackers who capture the redirect URL can obtain both the authorization code and PKCE verifier, defeating PKCE protection and enabling token redemption.","datePublished":"Apr 3, 2026, 8:45:41 PM","dateUpdated":"Sep 24, 2026, 2:17:31 PM","baseScore":6.0,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/openclaw/openclaw/security/advisories/GHSA-9jpj-g8vv-j5mf\nhttps://github.com/openclaw/openclaw/commit/a26f4d0f3ef0757db6c6c40277cc06a5de76c52f\nhttps://www.vulncheck.com/advisories/openclaw-pkce-verifier-exposure-via-oauth-state-parameter\n","aliases":"CVE-2026-34511\nGHSA-ch86-pxr9-j9h9\n","assigner":"VulnCheck","epss":0.25,"enisaIdProduct":[{"id":"3cd3268d-9ee1-38c2-a95c-465e23b36cdd","product":{"name":"OpenClaw","vendor":{"name":"n/a"}},"product_version":"0 \u003c2026.4.2"}],"enisaIdVendor":[{"id":"a0a87398-2377-3dbc-80c7-c3250a6ab452","vendor":{"name":"OpenClaw"}}],"enisaIdVulnerability":[{"id":"4626aca2-d22f-3002-9684-78e5cc154174","vulnerability":{"id":"CVE-2026-34511","description":"OpenClaw before 2026.4.2 reuses the PKCE verifier as the OAuth state parameter in the Gemini OAuth flow, exposing it through the redirect URL. Attackers who capture the redirect URL can obtain both the authorization code and PKCE verifier, defeating PKCE protection and enabling token redemption.","datePublished":"Apr 3, 2026, 8:45:41 PM","dateUpdated":"Sep 24, 2026, 2:17:31 PM","status":"PUBLISHED","baseScore":6.0,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/openclaw/openclaw/security/advisories/GHSA-9jpj-g8vv-j5mf\nhttps://github.com/openclaw/openclaw/commit/a26f4d0f3ef0757db6c6c40277cc06a5de76c52f\nhttps://www.vulncheck.com/advisories/openclaw-pkce-verifier-exposure-via-oauth-state-parameter\n","enisa_id":"EUVD-2026-18849\n","assigner":"VulnCheck","epss":0.25,"dataProcessed":"Nov 11, 2026, 7:24:15 AM","vulnerabilityProduct":[{"id":"bbc7a61b-eb8b-3b53-a387-95ecfac55bd1","product":{"name":"OpenClaw","vendor":{"name":"n/a"}},"product_version":"0 \u003c2026.4.2"}],"vulnerabilityVendor":[{"id":"6cf0ee48-332a-31ba-bcd9-b577c4fcea43","vendor":{"name":"OpenClaw"}}]}},{"id":"ce3c4de9-aef6-3f48-a3ef-5548bd0c2f54","vulnerability":{"id":"GHSA-ch86-pxr9-j9h9","description":"Duplicate Advisory: OpenClaw: Gemini OAuth exposed the PKCE verifier through the OAuth state parameter","datePublished":"Apr 3, 2026, 9:31:43 PM","dateUpdated":"Apr 7, 2026, 2:24:10 PM","baseScore":0.0,"references":"https://github.com/openclaw/openclaw/security/advisories/GHSA-9jpj-g8vv-j5mf\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-34511\nhttps://github.com/openclaw/openclaw/commit/a26f4d0f3ef0757db6c6c40277cc06a5de76c52f\nhttps://www.vulncheck.com/advisories/openclaw-pkce-verifier-exposure-via-oauth-state-parameter\n","enisa_id":"EUVD-2026-18849\n","aliases":"GHSA-ch86-pxr9-j9h9\n","epss":0.0,"dataProcessed":"Nov 9, 2026, 3:47:06 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"a2f9aecc-83b5-3674-89f5-427fc7e3cefb","advisory":{"id":"WID-SEC-W-2026-0980","description":"OpenClaw: Mehrere Schwachstellen","summary":"Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um Daten zu manipulieren, Sicherheitsmechanismen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen..","datePublished":"Apr 6, 2026, 10:00:00 PM","dateUpdated":"Apr 28, 2026, 10:00:00 PM","baseScore":0.0,"references":"https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-0980.json\nhttps://wid.cert-bund.de/portal/wid/securityadvisory?name\u003dWID-SEC-2026-0980\n","aliases":"CVE-2026-34425\nCVE-2026-34426\nCVE-2026-34511\nCVE-2026-41295\nCVE-2026-41298\nCVE-2026-41301\nCVE-2026-41339\nCVE-2026-41346\nCVE-2026-41348\nCVE-2026-41351\nCVE-2026-41352\nCVE-2026-41354\nCVE-2026-41358\nCVE-2026-41360\nCVE-2026-41362\nCVE-2026-41372\nCVE-2026-41383\nCVE-2026-41388\nCVE-2026-41398\nCVE-2026-41400\nCVE-2026-41407\n","source":{"id":8,"name":"csaf_certbund"},"advisoryProduct":[{"id":"65bb314f-de13-38cf-b85d-be04a487bc80","product":{"name":"OpenClaw","vendor":{"name":"n/a"}}},{"id":"dc36dae7-028f-3bd0-9926-b6c0e11bf55c","product":{"name":"2026.4.2","vendor":{"name":"open source"}}}]}}]}