GHSA-9JPJ-G8VV-J5MF: CVE-2026-34511: PKCE...

CVE-2026-34511: PKCE Verifier Exposure via OAuth State Parameter in OpenClaw Vulnerability ID: GHSA-9JPJ-G8VV-J5MF CVSS Score: 6.0 Published: 2026-04-04 OpenClaw versions prior to 2026.4.2 contain a security parameter isolation violation in the Gemini OAuth flow. The application incorrectly reuses the PKCE code_verifier as the value for the OAuth state parameter, exposing the secret verifier in plaintext via the redirect URI and defeating PKCE protections. TL;DR The OpenClaw Gemini extension lea