Product
The @openclaw/matrix npm package (versions 2026.2.2 to 2026.8.0) fails to properly enforce case-sensitivity when deriving authorization identities from Matrix user IDs, potentially allowing unauthorized users to hijack administrative privileges.