| Package | Affected versions | Patched versions |
|---|---|---|
| openclaw | < 2026.3.28 | 2026.3.28 |
| openclaw | < 2026.3.28 | 2026.3.28 |
Removing a device or revoking its token updated stored credentials but did not disconnect already-authenticated WebSocket sessions.
A revoked device could continue using its existing live session until reconnect, extending access beyond credential removal.
src/gateway/server-methods/devices.ts, src/gateway/server.impl.ts
<= 2026.3.24>= 2026.3.282026.3.28 contains the fix.Fixed by commit 7a801cc451 (Gateway: disconnect revoked device sessions).
OpenClaw thanks @AntAISecurityLab for reporting.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free