What is GHSA-p44v-rx83-vjp4?

GHSA-p44v-rx83-vjp4 is a security advisory published by GitHub Security Advisories with High severity. Duplicate Advisory: Discord allowFrom could bind to mutable display names

Why does GHSA-p44v-rx83-vjp4 have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

What is the CVSS v3 score of GHSA-p44v-rx83-vjp4?

GHSA-p44v-rx83-vjp4 has a CVSS v3 base score of 8.1, published by GitHub Security Advisories.

Which products are affected by GHSA-p44v-rx83-vjp4?

GHSA-p44v-rx83-vjp4 affects 1 product, including: npm/openclaw:\u003c= 2026.5.6.

⚠ Withdrawn by GitHub Security Advisories

Withdrawn: June 18, 2026

GHSA-p44v-rx83-vjp4HighCVSS 8.1Disclosed before NVD

Duplicate Advisory: Discord allowFrom could bind to mutable display names

Vendor

GitHub Security Advisories

Published

June 16, 2026

Last Modified

June 18, 2026

📋 Description

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-cw4q-gqg5-g38h. This link is maintained to preserve external references.

Original Description

OpenClaw before 2026.5.7 contains a privilege escalation vulnerability where the allowFrom feature improperly validates Discord account identity using mutable display names instead of immutable user IDs. Attackers with Discord accounts can change their display name to match a policy entry and gain unauthorized agent access intended for another Discord identity.

🎯 Affected products1

npm/openclaw:<= 2026.5.6

🔗 References (4)

https://github.com/openclaw/openclaw/security/advisories/GHSA-cw4q-gqg5-g38h
https://nvd.nist.gov/vuln/detail/CVE-2026-53849
https://www.vulncheck.com/advisories/openclaw-privilege-escalation-via-mutable-discord-display-names-in-allowfrom
https://github.com/advisories/GHSA-p44v-rx83-vjp4