GHSA-rqpp-rjj8-7wv8: OpenClaw: WebSocket shared-auth connections could self-declare elevated scopes

A logic flaw in the OpenClaw gateway WebSocket connect path allowed certain device-less shared-token or password-authenticated backend connections to keep client-declared scopes without server-side binding. A shared-authenticated client could present elevated scopes such as operator.admin even though those scopes were not tied to a device identity or an explicitly trusted Control UI path.