GHSA-p464-m8x6-vhv8: OpenClaw: MS Teams webhook parses body before JWT validation, enabling unauthenticated resource exhaustion

April 3, 2026

MS Teams webhook parses body before JWT validation, enabling unauthenticated resource exhaustion

References

github.com/advisories/GHSA-p464-m8x6-vhv8
github.com/openclaw/openclaw
github.com/openclaw/openclaw/commit/3834d47099dd13c8244ed6de8b9ea9855c553623
github.com/openclaw/openclaw/releases/tag/v2026.3.31
github.com/openclaw/openclaw/security/advisories/GHSA-p464-m8x6-vhv8

Code Behaviors & Features

Detect and mitigate GHSA-p464-m8x6-vhv8 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →