CVE-2026-34511

MediumCVSS 5.9/10Last modified Jul 24, 2026

Description

OpenClaw before 2026.4.2 reuses the PKCE verifier as the OAuth state parameter in the Gemini OAuth flow, exposing it through the redirect URL. Attackers who capture the redirect URL can obtain both the authorization code and PKCE verifier, defeating PKCE protection and enabling token redemption.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-330

Affected software

No affected versions have been published.

Timeline

Published
Apr 3, 2026
Last modified
Jul 24, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-345128.1OpenClaw before 2026.3.25 contains an improper access control vulnerability in the HTTP /sessions/:sessionKey/kill route that allows any beaCVE-2026-345137.5AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an unbounded DNS cache could resultCVE-2026-345145.3AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the contenCVE-2026-345157.5AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, on Windows the static resource handCVE-2026-345167.5AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, a response with an excessive numberCVE-2026-345175.3AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, for some multipart form fields, aioCVE-2026-345185.3AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, when following redirects to a diffeCVE-2026-345195.3AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the reasonCVE-2026-34527.2Concrete CMS below version 9.4.8 is vulnerable to Remote Code Execution by stored PHP object injection into the Express Entry List block viaCVE-2026-345209.1AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, the C parser (the default for most CVE-2026-345228.1SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generationCVE-2026-345235.3SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation