CVE-2026-100540 — OpenClaw Feishu before 2026.8.1 Authentication Bypass via Disabled Account
OpenClaw Feishu before 2026.8.1 fails to validate whether a configured default account is disabled before selecting it for model tool operations. Attackers can exploit multi-acc…
Published: 2026-09-26 · CVSS: 7.6 · CVSS 4.0
OpenClaw Feishu before 2026.8.1 fails to validate whether a configured default account is disabled before selecting it for model tool operations. Attackers can exploit multi-account setups where a disabled default account retains credentials to read or modify Feishu resources through a revoked identity.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7