GHSA-2pr2-hcv6-7gwv
OpenClaw's device removal and token revocation do not terminate active WebSocket sessions
Packages
Details
As written in the advisory (Markdown source, shown as plain text).
## Summary
Removing a device or revoking its token updated stored credentials but did not disconnect already-authenticated WebSocket sessions.
## Impact
A revoked device could continue using its existing live session until reconnect, extending access beyond credential removal.
## Affected Component
`src/gateway/server-methods/devices.ts, src/gateway/server.impl.ts`
## Fixed Versions
- Affected: `<= 2026.3.24`
- Patched: `>= 2026.3.28`
- Latest stable `2026.3.28` contains the fix.
## Fix
Fixed by commit `7a801cc451` (`Gateway: disconnect revoked device sessions`).
OpenClaw thanks @AntAISecurityLab for reporting.
References
External links from the advisory. They lead to third-party sites.
- https://github.com/openclaw/openclaw/security/advisories/GHSA-2pr2-hcv6-7gwv
- https://nvd.nist.gov/vuln/detail/CVE-2026-34503
- https://github.com/openclaw/openclaw/commit/7a801cc451e9e667b705eeccff651923a1b8c863
- https://github.com/openclaw/openclaw
- https://www.vulncheck.com/advisories/openclaw-incomplete-websocket-session-termination-on-device-removal-and-token-revocation