Staging Environment: Content and features may be unstable or change without notice.
Advisory details: github_osv / GHSA-77w2-crqv-cmv3
Advisory ID github_osv/GHSA-77w2-crqv-cmv3
Aliases CVE-2026-35664
Summary OpenClaw: Feishu Raw Card Send Surface Can Mint Legacy Card Callbacks That Bypass DM Pairing ## Summary Feishu Raw card Send Surface Can Mint Legacy Card Callbacks That Bypass DM Pairing ## Affected Packages / Versions - Package: `openclaw` - Affected versions: `<= 2026.3.24` - First patched version: `2026.3.25` - Latest published npm version at verification time: `2026.3.24` ## Details Feishu raw card sends could previously mint legacy callback payloads that bypassed DM pairing and let unpaired recipients reach callback handling. Commit `81c45976db532324b5a0918a70decc19520dc354` rejects legacy raw-card command payloads so callbacks stay on the normal paired path. Verified vulnerable on tag `v2026.3.24` and fixed on `main` by commit `81c45976db532324b5a0918a70decc19520dc354`. ## Fix Commit(s) - `81c45976db532324b5a0918a70decc19520dc354`
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (2)
CWE-863 Incorrect Authorization
CWE-288 Authentication Bypass Using an Alternate Path or Channel
System Score Found at
generic_textual MODERATE
Reference id Reference type URL
https://github.com/openclaw/openclaw
https://github.com/openclaw/openclaw/commit/81c45976db532324b5a0918a70decc19520dc354
https://github.com/openclaw/openclaw/security/advisories/GHSA-77w2-crqv-cmv3
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
There are no known vectors.

Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-14T14:57:40Z/

Decision: Track

Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2026/35xxx/CVE-2026-35664.json

Source Advisory: vulnrichment/CVE-2026-35664

View SSVC decision tree 
[{'Exploitation': 'none'},
 {'Automatable': 'yes'},
 {'Technical Impact': 'partial'},
 {'Mission Prevalence': 'minimal'},
 {'Public Well-being Impact': 'material'},
 {'Mission & Well-being': 'medium'}]