---
id: CVE-2026-34511
title: >-
  OpenClaw before 2026.4.2 reuses the PKCE verifier as the OAuth state parameter
  in the Gemini OAuth flow, exposing it through the redirect URL
summary: >-
  OpenClaw before 2026.4.2 reuses the PKCE verifier as the OAuth state parameter
  in the Gemini OAuth flow, exposing it through the redirect URL. Attackers who
  capture the redirect URL can obtain both the authorization code and PKCE
  verifie…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N'
cwe:
  - CWE-330
vendor: openclaw
product: openclaw
affected:
  - openclaw < 2026.4.2
patched:
  - openclaw 2026.4.2
published: '2026-04-03'
updated: '2026-07-24'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-34511'
references:
  - url: >-
      https://github.com/openclaw/openclaw/commit/a26f4d0f3ef0757db6c6c40277cc06a5de76c52f
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/openclaw/openclaw/security/advisories/GHSA-9jpj-g8vv-j5mf
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/openclaw-pkce-verifier-exposure-via-oauth-state-parameter
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
epss: 0.00427
epssPercentile: 0.34308
ingestedAt: '2026-07-25T22:05:04.960Z'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-04-06T16:56:07.477987Z'
---

## Overview

OpenClaw before 2026.4.2 reuses the PKCE verifier as the OAuth state parameter in the Gemini OAuth flow, exposing it through the redirect URL. Attackers who capture the redirect URL can obtain both the authorization code and PKCE verifier, defeating PKCE protection and enabling token redemption.

## Affected

- `openclaw < 2026.4.2`

## Remediation

Upgrade past the affected range:

- `openclaw 2026.4.2`