Summary
MS Teams webhook parses body before JWT validation, enabling unauthenticated resource exhaustion
Current Maintainer Triage
- Status: open
- Normalized severity: medium
- Assessment: v2026.3.28 still parses Teams JSON after only a Bearer-prefix gate and before real JWT validation, and the auth-before-parse fix is not yet shipped.
Affected Packages / Versions
- Package:
openclaw (npm)
- Latest published npm version:
2026.3.31
- Vulnerable version range:
<=2026.3.28
- Patched versions:
>= 2026.3.31
- First stable tag containing the fix:
v2026.3.31
Fix Commit(s)
3834d47099dd13c8244ed6de8b9ea9855c553623 — 2026-03-30T13:46:40+01:00
OpenClaw thanks @AntAISecurityLab for reporting.
References
AntAISecurityLab Reporter
Summary
MS Teams webhook parses body before JWT validation, enabling unauthenticated resource exhaustion
Current Maintainer Triage
Affected Packages / Versions
openclaw(npm)2026.3.31<=2026.3.28>= 2026.3.31v2026.3.31Fix Commit(s)
3834d47099dd13c8244ed6de8b9ea9855c553623— 2026-03-30T13:46:40+01:00OpenClaw thanks @AntAISecurityLab for reporting.
References