Security advisories

critical2026-04-03

Better Auth Has Two-Factor Authentication Bypass via Premature Session Caching (session.cookieCache)

better-auth/better-auth · GHSA-xg6x-h9c9-2m83

high2026-04-03

CVE-2026-34986-Go JOSE Panics in JWE decryption

go-jose/go-jose · GHSA-78h2-9frx-2jm8

low2026-04-03

CVE-2026-41382-OpenClaw: Discord voice ingress authorization can be bypassed via channel, name, and stale-role validation gaps

openclaw/openclaw · GHSA-x2m8-53h4-6hch

low2026-04-03

CVE-2026-41341-OpenClaw: Discord Component Interaction Misclassifies Group DM as Direct Message

openclaw/openclaw · GHSA-6336-qqw9-v6x6

medium2026-04-03

CVE-2026-41300-OpenClaw: Endpoint persists after trust decline, leaking gateway credentials

openclaw/openclaw · GHSA-9f4w-67g7-mqwv

medium2026-04-03

CVE-2026-41403-OpenClaw: diffs viewer misclassifies proxied remote requests as loopback when `allowRemoteViewer` is disabled

openclaw/openclaw · GHSA-3xv9-89fm-7h4r

low2026-04-03

CVE-2026-41348-OpenClaw: Discord Slash Commands Bypass Group DM Channel Allowlist

openclaw/openclaw · GHSA-rvvf-6vh3-9j43

high2026-04-03

CVE-2026-41393-OpenClaw: macOS Tailnet DNS Spoofing & Credential Exfiltration

openclaw/openclaw · GHSA-q9w8-cf67-r238

medium2026-04-03

OpenClaw: Telegram legacy allowFrom migration fans default-account trust into all named accounts

openclaw/openclaw · GHSA-f693-58pc-2gfr

low2026-04-03

CVE-2026-41388-OpenClaw: Tlon Startup Migration Rehydrates Empty-Array Revocations From File Config

openclaw/openclaw · GHSA-3pm9-5j7m-59vc

high2026-04-03

CVE-2026-41386-OpenClaw: Unbound bootstrap setup codes allow privilege escalation during pairing

openclaw/openclaw · GHSA-gg9v-mgcp-v6m7

high2026-04-03

OpenClaw: Node browser proxy `allowProfiles` bypass through persistent profile mutation and runtime profile selection

openclaw/openclaw · GHSA-h5hg-h7rr-gpf3

medium2026-04-03

CVE-2026-41381-OpenClaw: Discord voice manager bypasses channel-level member access allowlist

openclaw/openclaw · GHSA-cqgw-44wg-44rf

medium2026-04-03

CVE-2026-41331-OpenClaw: Telegram audio preflight transcription enables resource consumption by unauthorized senders

openclaw/openclaw · GHSA-m6fx-m8hc-572m

high2026-04-03

CVE-2026-41378-OpenClaw: Paired node escalates to gateway RCE via unrestricted node.event agent dispatch

openclaw/openclaw · GHSA-gjm7-hw8f-73rq

critical2026-04-03

CVE-2026-41296-OpenClaw: Sandbox escape via TOCTOU race in remote FS bridge readFile

openclaw/openclaw · GHSA-9p3r-hh9g-5cmg

medium2026-04-03

CVE-2026-41400-OpenClaw: Voice-call still parses large WebSocket frames before start validation (Incomplete fix for CVE-2026-32062)

openclaw/openclaw · GHSA-2w79-r9g8-wmcr

low2026-04-03

CVE-2026-41356-OpenClaw: Gateway `device.token.rotate` does not terminate active WebSocket sessions after credential rotation

openclaw/openclaw · GHSA-rfqg-qgf8-xr9x

medium2026-04-03

CVE-2026-41333-OpenClaw: Fake DeviceToken Bypasses Shared Auth Rate Limiting

openclaw/openclaw · GHSA-6p8r-6m93-557f

high2026-04-03

CVE-2026-41369-OpenClaw: Host exec environment sanitization misses package, registry, Docker, compiler, and TLS override variables

openclaw/openclaw · GHSA-cg7q-fg22-4g98