{"data":{"id":"aba4ad3b-ea8f-483c-86b4-e22c7f0c93af","title":"GHSA-7rcp-mxpq-72pj: OpenClaw Chutes manual OAuth state validation bypass can cause credential substitution","summary":"The manual Chutes OAuth login flow in OpenClaw accepted attacker-controlled callback input, bypassing OAuth CSRF state validation. If a user is tricked into pasting attacker-provided OAuth callback data, OpenClaw can exchange an attacker-obtained authorization code and persist tokens for the wrong Chutes account. Affected package: openclaw (npm) at versions <= 2026.2.13 using the manual Chutes OAuth login flow; the automatic local callback flow is not affected.","solution":"The manual flow now requires the full redirect URL (must include `code` and `state`), validates the returned `state` against the expected value, and rejects code-only pastes. Fix commit: a99ad11a4107ba8eac58f54a3c1a8a0cf5686f47.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-7rcp-mxpq-72pj","publishedAt":"2026-02-18T17:41:00.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":["openclaw@< 2026.2.14 (fixed: 2026.2.14)"],"affectedPackageNames":["openclaw"],"affectedPackageRefs":["npm:openclaw"],"affectedVendors":[],"affectedVendorsRaw":["OpenClaw","Chutes"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":["GHSA-7rcp-mxpq-72pj"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":null,"fixReleasedAt":"2026-02-15T02:59:48.267Z","daysToFix":-3,"fixCheckedAt":"2026-10-29T21:40:56.764Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.8,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"openclaw","fixedVersion":"2026.2.14","matchedVersion":"2026.2.14","fixReleasedAt":"2026-02-15T02:59:48.267Z","daysToFix":-3,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:40:56.616Z"}]}}