CVE-2026-53830
MEDIUM
NVD
CVSS Score
6.5
Severity
MEDIUM
Published
Jun 12, 2026
Vendor
unknown
Description
OpenClaw before 2026.4.22 contains a webhook secret revocation bypass vulnerability allowing callers with old Slack and Zalo webhook secrets to remain active after secrets.reload. Attackers can exploit the stale-secret window to deliver webhook events after operator-expected secret revocation, potentially accepting previous credentials.