By design, the login tool should only be accessible to the configured owner of the service. However, because the tool fails to preserve or validate the sender's owner status during the interaction, any non-owner user capable of steering the tool can invoke the login functionality. This action forces the service to generate a new QR code for a configured account. This process effectively disconnects the currently active WhatsApp account from the Gateway, leading to a denial-of-service condition. While the primary impact is service disruption, an attacker with physical access to the device can perform a subsequent QR code scan to relink the gateway to an account of their choosing, leading to unauthorized account control.

Impact

Successful exploitation leads to immediate denial-of-service as the active WhatsApp account is disconnected from the Gateway. In scenarios where an attacker can scan the newly generated QR code, they can hijack the gateway's WhatsApp integration. This vulnerability affects all environments deploying @openclaw/whatsapp versions earlier than 2026.8.1.

Recommendation

• Immediately upgrade the @openclaw/whatsapp dependency to version 2026.8.1 or later.
• Audit logs for unauthorized access attempts to the login tool path or unexpected QR code generation events triggered by non-administrative service accounts.
• Implement stricter access control logic at the application layer if upgrading is delayed, ensuring only authorized user IDs are permitted to interact with the channel-tool path.