Extra Mitigation Curation

OpenClaw affected by cross-site request forgery (CSRF) through loopback browser mutation endpoints Browser-facing localhost mutation routes accepted cross-origin browser requests without explicit Origin/Referer validation. Loopback binding reduces remote exposure but does not prevent browser-initiated requests from malicious origins.