mediumCVSS 5.3Vulnerability

GHSA-ch86-pxr9-j9h9

### Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9jpj-g8vv-j5mf. This link is maintained to preserve external references. ### Original Description OpenClaw before 2026.4.2 reuses the PKCE verifier as the OAuth state parameter in the Gemini OAuth flow, exposing it through the redirect URL. Attackers who capture the redirect URL can obtain both the authorization code and PKCE verifier, defeating PKCE protection and enabling token redemption.

Properties

ghsa_id
GHSA-ch86-pxr9-j9h9
severity
medium
summary
Duplicate Advisory: OpenClaw: Gemini OAuth exposed the PKCE verifier through the OAuth state parameter
cvss_score
5.3
cve_id
GHSA-ch86-pxr9-j9h9
cvss_vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
is_ghsa_only
true
ghsa_published
2026-04-03T21:31:43Z
source_url
https://github.com/advisories/GHSA-ch86-pxr9-j9h9
ghsa_updated
2026-04-07T14:24:12Z

Related Entities (3)

AFFECTS (1)

[Software]npm/OpenClaw

HAS_WEAKNESS (1)

[Weakness]Use of Insufficiently Random Values

REPORTED_BY (1)

[Source]GitHub Advisory Database

Explore deeper with Ninja Signal's threat intelligence graph