Vulnerability · Published Jul 17, 2026 · Assigned by VulnCheck
CVE-2026-62224OpenClaw MS Teams < 2026.5.12 Authorization Bypass
Medium 5.4
In plain English
A medium-severity authentication bypass by spoofing in msteams from openclaw. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).
Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)0.3%top 82.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
OpenClaw MS Teams before 2026.5.12 contain an authorization bypass vulnerability where the allowFrom feature binds to mutable display names. Attackers with lower-trust access can perform actions requiring stronger authorization by exploiting the mutable display name binding in the affected feature.
Affected products (as reported)
Weakness: CWE-290, CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
References
- GitHub Security Advisory (GHSA-7w4v-g4m6-j88v) vendor-advisory
- VulnCheck Advisory: OpenClaw MS Teams < 2026.5.12 Authorization Bypass third-party-advisory