CVE-2026-32231
HIGH
8,2
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: low
Integrity: high
Availability: none
Description
AI Translation Available
ZeptoClaw is a personal AI assistant. Prior to 0.7.6, the generic webhook channel trusts caller-supplied identity fields (sender, chat_id) from the request body and applies authorization checks to those untrusted values. Because authentication is optional and defaults to disabled (auth_token: None), an attacker who can reach POST /webhook can spoof an allowlisted sender and choose arbitrary chat_id values, enabling high-risk message spoofing and potential IDOR-style session/chat routing abuse. This vulnerability is fixed in 0.7.6.
306
Missing Authentication for Critical Function
DraftCommon Consequences
Security Scopes Affected:
Access Control
Other
Potential Impacts:
Gain Privileges Or Assume Identity
Varies By Context
Applicable Platforms
Technologies:
Cloud Computing, ICS/OT
345
Insufficient Verification of Data Authenticity
DraftCommon Consequences
Security Scopes Affected:
Integrity
Other
Potential Impacts:
Varies By Context
Unexpected State
Applicable Platforms
Technologies:
ICS/OT
https://github.com/qhkm/zeptoclaw/commit/bf004a20d3687a0c1a9e052ec79536e30d6de1…
https://github.com/qhkm/zeptoclaw/pull/324
https://github.com/qhkm/zeptoclaw/releases/tag/v0.7.6
https://github.com/qhkm/zeptoclaw/security/advisories/GHSA-46q5-g3j9-wx5c