GHSA-cxfr-3qp8-hpmw: Duplicate Advisory: OpenClaw: Zalo webhook rate limiting could be bypassed before secret validation

March 31, 2026 (updated April 6, 2026)

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-5m9r-p9g7-679c. This link is maintained to preserve external references.

Original Description

OpenClaw before 2026.3.12 applies rate limiting only after successful webhook authentication, allowing attackers to bypass rate limits and brute-force webhook secrets. Attackers can submit repeated authentication requests with invalid secrets without triggering rate limit responses, enabling systematic secret guessing and subsequent forged webhook submission.

References

Code Behaviors & Features

Detect and mitigate GHSA-cxfr-3qp8-hpmw with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →