[openclaw] OpenClaw: Zalo webhook rate limiting could be bypassed before secret validation

**[openclaw] OpenClaw: Zalo webhook rate limiting could be bypassed before secret validation**

Summary The Zalo webhook handler applied request rate limiting only after webhook authentication succeeded. Requests with an invalid secret returned 401 but did not count against the rate limiter, allowing repeated secret guesses without triggering 429. Impact This made brute-force guessing materially easier for weak but policy-compliant webhook secrets. Once the secret was guessed, an attacker could submit forged Zalo webhook traffic. Affected versions openclaw <= 2026.3.11 Patch Fixed in openclaw 2026.3.12...

---

**[devsupporter 해설]**

이 기사는 GitHub Security Advisories에서 제공하는 최신 개발 동향입니다. 관련 도구나 기술에 대해 더 알아보시려면 원본 링크를 참고하세요.