OpenClaw Timing Vulnerability in Tlon DM Authorization Process

A vulnerability exists in OpenClaw versions prior to 2026.3.22, where the application processes cited content in direct messages before completing necessary authorization checks. This flaw allows for the manipulation or access of content without proper authorization, creating a potential security risk.

Impact

Exploitation of this vulnerability could lead to unauthorized access or manipulation of content in direct messages, bypassing established authorization protocols.

Reproduction

To reproduce this vulnerability, send a direct message that includes cited content before the recipient has completed the necessary authorization process. The application will process the citation before finalizing authorization, allowing unauthorized access to the cited content.

Remediation

Users can update to OpenClaw version 2026.3.22 or later to address this vulnerability.