CVE-2026-34511: OpenClaw before 2026.4.2 reuses the PKCE verifier as the OAuth state parameter in the Gemini OAuth flow, exposing it thr

OpenClaw versions before 2026.4.2 have a security flaw in their Google Gemini login process where a secret value (PKCE verifier, a random code used to protect OAuth authorization) is reused as the state parameter (a value meant to prevent certain attacks) and exposed in the redirect URL (the page the user is sent to after login). Attackers who intercept this URL can steal both the authorization code and the PKCE verifier, bypassing the protection it was supposed to provide and allowing them to steal login tokens.