CVE-2026-43572

OpenClaw 2026.4.10 < 2026.4.14 - Missing Sender Authorization in Microsoft Teams SSO Invoke Handler

State: Published
Severity: 6.3 Medium
Published: May 5, 2026
Updated: May 5, 2026
Reserved: May 1, 2026

Description

OpenClaw versions 2026.4.10 before 2026.4.14 contain a missing authorization vulnerability in the Microsoft Teams SSO invoke handler that fails to apply sender allowlist checks. Attackers can bypass sender authorization by sending SSO invoke requests that are processed without proper validation, allowing unauthorized access to Teams SSO signin functionality.

Scores

CVSS	Score	Vector	Source
4.0	6.3 Medium	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N	VulnCheck
3.1	5.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	VulnCheck

Weaknesses

CWE-862 Missing Authorization

Affected Products

Product	Versions
OpenClawOpenClaw	2026.4.10 to before 2026.4.14Affected 2026.4.14Not affected

References

GitHub Security Advisory (GHSA-gc9r-867r-j85f)vendor-advisory
Patch Commitpatch
VulnCheck Advisory: OpenClaw 2026.4.10 < 2026.4.14 - Missing Sender Authorization in Microsoft Teams SSO Invoke Handlerthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.