| Package | Affected versions | Patched versions |
|---|---|---|
| openclaw | < 2026.3.25 | 2026.3.25 |
| openclaw | ≤ 2026.3.24 |
BlueBubbles Webhook Missing Guess Rate Limiting Enables Brute-Force Guessing of Weak Webhook Password
openclaw<= 2026.3.242026.3.252026.3.24BlueBubbles webhook auth previously rejected wrong passwords without throttling repeated guesses, allowing brute-force attempts against weak webhook passwords. Commit 5e08ce36d522a1c96df2bfe88e39303ae2643d92 adds repeated-guess throttling before auth failure responses.
Verified vulnerable on tag v2026.3.24 and fixed on main by commit 5e08ce36d522a1c96df2bfe88e39303ae2643d92.
5e08ce36d522a1c96df2bfe88e39303ae2643d92Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free