## Summary
OpenClaw versions prior to 2026.2.21 can allow an authentication bypass in the Control UI when gateway.controlUi.allowInsecureAuth: true is explicitly enabled and the gateway is exposed over plaintext HTTP. In that misconfiguration, attackers with leaked/intercepted credentials may obtain high-privilege Control UI access by bypassing device identity and pairing verification.
## Technical Details
- The bypass occurs only under an explicitly insecure deployment choice:
- gateway.controlUi.allowInsecureAuth set to true
- gateway reachable over plaintext HTTP (non-secure context)
- The fix was merged on main in commit 40a292619e1f2be3a3b1db663d7494c9c2dc0abf (PR #20684).
- Updated tests indicate the server should reject Control UI connections that do not satisfy secure context / device identity requirements, even when insecure auth is enabled.
- The commit adds/adjusts test cases such as:
- rejects control ui without device identity even when insecure auth is enabled
- rejects control ui password-only auth when insecure auth is enabled
- does not bypass pairing for control ui device identity when insecure auth is enabled
## Affected
- openclaw (npm)
- Affected published versions: <= 2026.2.19-2
- Fixed in: 2026.2.21
## Impact
- High-privilege Control UI access without the intended device identity + pairing guarantees, when credentials are leaked/intercepted and the gateway is exposed over plaintext HTTP.
- CVSS (from provided data): 8.1 with AV:N/AC:L/PR:L/UI:N.
## Mitigation
1. Upgrade OpenClaw to 2026.2.21 (or later) to incorporate the fix from commit 40a292619e1f2be3a3b1db663d7494c9c2dc0abf.
2. Remove the insecure configuration: set gateway.controlUi.allowInsecureAuth to false (or do not explicitly enable it).
3. Ensure the gateway is not exposed over plaintext HTTP; use a secure transport so the Control UI authentication is enforced in a secure context.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CWE-78