CVE-2026-25253: 1-Click RCE in OpenClaw Through Auth Token Exfiltration

**CVE-2026-25253** is a critical logic vulnerability in OpenClaw (formerly Clawdbot/Moltbot) that permits a one‑click attack: a malicious gatewayUrl causes the application to connect to an attacker WebSocket, leak the user's authToken, enable Cross‑Site WebSocket Hijacking to reach localhost, disable prompts and container protections, and then execute arbitrary commands on the host; affected versions include releases up to v2026.1.24-1 and recommended mitigations are immediate patching, rotating tokens and connected secrets, and auditing logs and permissions.