What is GHSA-wrmq-9fc4-gwwj?

GHSA-wrmq-9fc4-gwwj is a security advisory published by GitHub Security Advisories with High severity. Duplicate Advisory: Pairing-scoped device session could restore revoked node token authority

Why does GHSA-wrmq-9fc4-gwwj have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

What is the CVSS v3 score of GHSA-wrmq-9fc4-gwwj?

GHSA-wrmq-9fc4-gwwj has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

Which products are affected by GHSA-wrmq-9fc4-gwwj?

GHSA-wrmq-9fc4-gwwj affects 1 product, including: npm/openclaw:\u003c 2026.5.26.

⚠ Withdrawn by GitHub Security Advisories

Withdrawn: June 18, 2026

GHSA-wrmq-9fc4-gwwjHighCVSS 8.8Disclosed before NVD

Duplicate Advisory: Pairing-scoped device session could restore revoked node token authority

Vendor

GitHub Security Advisories

Published

June 16, 2026

Last Modified

June 18, 2026

📋 Description

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-q99w-vh6v-q3v7. This link is maintained to preserve external references.

Original Description

OpenClaw before 2026.5.26 contains an authorization bypass vulnerability where a surviving pairing-scoped device session can re-establish node token authority after revocation. Attackers with a paired device can regain WebSocket node-level access without renewed approval, weakening revocation controls and maintaining unauthorized access longer than intended.

🎯 Affected products1

npm/openclaw:< 2026.5.26

🔗 References (4)

https://github.com/openclaw/openclaw/security/advisories/GHSA-q99w-vh6v-q3v7
https://nvd.nist.gov/vuln/detail/CVE-2026-53843
https://www.vulncheck.com/advisories/openclaw-node-token-revocation-bypass-via-pairing-scoped-device-session
https://github.com/advisories/GHSA-wrmq-9fc4-gwwj