Security
OpenClaw's Waitlist API Has Zero Authorization Checks. Anyone Can Cancel Your Reservation.
A waitlist API that lets any user cancel any other user's reservation is not a niche bug. It is the same broken-access-control pattern that OWASP ranks as the web's number-one risk, arriving early in an agent project's molt cycle.
Aug 10, 2026Verified