OpenClaw Client PKCE Verifier Information Disclosure Vulnerability

A vulnerability allowing remote attackers to disclose stored credentials has been identified in the OpenClaw macOS application, specifically in versions through 2026.2.24. This issue arises during the OAuth authorization process, where sensitive data is inadvertently exposed in the authorization URL query string. Exploitation of this vulnerability requires user interaction to initiate the OAuth flow.

Impact

Exploitation of this vulnerability could lead to unauthorized disclosure of stored credentials, potentially allowing for further compromise.

Remediation

OpenClaw has removed the vulnerable OAuth implementation from the macOS onboarding process. Users should update to version 2026.2.25 or later.