TI-2026-70735 CVE-2026-108757 · GHSA-w679-vj8x-2q83
Missing authentication in Nexting pinclaw lets attackers inject prompts
Priority LOW 31
Nexting pinclaw OpenClaw channel plugin through 0.3.0 contains a missing authentication vulnerability in src/core/http-router.ts that skips the authToken check on POST /pinclaw/send.