Missing Authorization in OpenClaw - CVE-2026-100532
Published: November 3, 2026
Vulnerability details
The vulnerability allows a remote user to disconnect or replace the Gateway's WhatsApp account, causing a denial of service or unauthorized account relinking.
The vulnerability exists due to missing authorization in the WhatsApp login tool when invoked through the generic channel-tool path without preserving the originating sender's owner status. A remote user can steer an admitted non-owner turn to request a forced login and obtain a new QR code for a configured account to disconnect the account or initiate unauthorized relinking.
Successful account takeover requires scanning the returned QR code with another phone. The affected boundary is the owner-only tool restriction, not WhatsApp transport authentication.