Information Exposure Through Timing Discrepancy in OpenClaw - #VU125270

Detailed vulnerability description

The vulnerability allows a remote attacker to disclose secret length information through timing differences.

The vulnerability exists due to observable timing discrepancy in shared-secret comparison call sites when processing shared-secret comparisons with early length-mismatch checks. A remote attacker can measure response timing differences to disclose secret length information through timing differences.

The issue weakens the intended constant-time handling for shared secrets and does not by itself demonstrate authentication bypass.

Remediation

Sources

• https://github.com/openclaw/openclaw/security/advisories/GHSA-jj6q-rrrf-h66h