CVE-2026-34511: OpenClaw < 2026.4.2 - PKCE Verifier Exposure via OAuth State Parameter
Summary
Before OpenClaw 2026.4.2, the Gemini OAuth flow reused the PKCE verifier as the OAuth state value. Because the provider reflected state back in the redirect URL, the verifier could be exposed alongside the authorization code.
Impact
Anyone who could capture the redirect URL could learn both the authorization code and the PKCE verifier, defeating PKCE's interception protection for that flow and enabling token redemption.
Affected Packages / Versions
- Package: openclaw (npm) - Affected versions: <= 2026.4.1 - Patched versions: >= 2026.4.2 - Latest published npm version: 2026.4.1
Fix Commit(s)
- a26f4d0f3ef0757db6c6c40277cc06a5de76c52f — separate OAuth state from the PKCE verifier
OpenClaw thanks @BG0ECV for reporting.
Other sources
OpenClaw before 2026.4.2 reuses the PKCE verifier as the OAuth state parameter in the Gemini OAuth flow, exposing it through the redirect URL. Attackers who capture the redirect URL can obtain both the authorization code and PKCE verifier, defeating PKCE protection and enabling token redemption.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/openclawto a version that resolves this vulnerability.Fixed in 2026.4.2 - Upgrade
Upgrade
npm/openclawto a version that resolves this vulnerability.Fixed in 2026.4.2Patch a26f4d0f3ef0757db6c6c40277cc06a5de76c52f
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34511?
CVE-2026-34511 is considered a medium severity vulnerability due to the potential exposure of sensitive information through the misuse of the OAuth state parameter.
How do I fix CVE-2026-34511?
To fix CVE-2026-34511, upgrade OpenClaw to version 2026.4.2 or later.
What does CVE-2026-34511 impact?
CVE-2026-34511 impacts OpenClaw versions prior to 2026.4.2 that utilize the Gemini OAuth flow.
What specific information is exposed by CVE-2026-34511?
CVE-2026-34511 allows for the potential exposure of the PKCE verifier via the OAuth state parameter reflected in the redirect URL.
Is CVE-2026-34511 related to OAuth security?
Yes, CVE-2026-34511 is related to OAuth security as it involves improper handling of the OAuth state parameter.