CVE-2026-10216: Weak Authentication Rate-Limiting in unitedbyai Droidclaw

Technical summary

CVE-2026-10216 resides in the claim endpoint handler (server/src/routes/pairing.ts) within unitedbyai droidclaw and stems from improper restriction of excessive authentication attempts. The vulnerability is categorized under CWE-307 (Improper Restriction of Excessive Authentication Attempts) and CWE-799 (Improper Control of Interaction Frequency), indicating insufficient rate-limiting or account lockout mechanisms. The attack surface is network-accessible, requires no user interaction, and no authentication privilege, but demands high attack complexity due to implementation-specific conditions. The CVSS v3.1 score of 3.7 (LOW severity) reflects limited confidentiality impact with no integrity or availability damage.

Business impact

The practical business risk is moderate but context-dependent. Organizations relying on droidclaw for API pairing or credential management face increased exposure to unauthorized account access if attackers can systematically probe credentials. The low CVSS score reflects that successful exploitation requires deliberate effort and yields only limited information disclosure rather than system compromise or data theft. For deployments where droidclaw guards sensitive operations, the cumulative risk of credential compromise warrants attention; for others, the impact is marginal.

Affected systems

unitedbyai droidclaw version 0.5.3 and all earlier versions are vulnerable. The vulnerability is triggered through the claim endpoint during the pairing authentication flow. Determine your current droidclaw version and deployment context (internal API, customer-facing service, etc.) to assess whether your organization is affected.

Exploitability

Public exploits are now available, lowering the barrier to weaponization. However, the attack complexity is rated as HIGH, meaning successful exploitation requires specific knowledge of the target system's configuration, timing, or other environmental factors. Automated or generic attacks are unlikely to succeed; targeted, manual effort is needed. This does not eliminate the risk—determined adversaries with reconnaissance capabilities can still exploit the flaw—but it does reduce the probability of opportunistic attacks.

Remediation

Upgrade unitedbyai droidclaw to a patched version as soon as one is released by the vendor. Until a patch is available, implement network-level mitigations: deploy a Web Application Firewall (WAF) or rate-limiting reverse proxy in front of the claim endpoint to enforce strict request throttling per IP or session, implement account lockout policies (e.g., temporary suspension after N failed attempts), and monitor authentication logs for unusual patterns. If droidclaw is not critical to operations, consider disabling or restricting access to the pairing feature until a fix is confirmed.

Patch guidance

Verify the vendor's security advisory on the unitedbyai GitHub repository or official security channel for the version number and release date of the patched build. Patch as soon as testing confirms compatibility with your environment. Given the low CVSS and high attack complexity, patches can be scheduled in a standard maintenance window rather than emergency maintenance, but should not be deferred indefinitely.

Detection guidance

Monitor authentication logs for the claim endpoint (server/src/routes/pairing.ts) for anomalies: rapid successive failed authentication attempts from a single IP, burst patterns that deviate from normal user behavior, or repeated attempts with variations in credentials or headers. Implement alerting on rate-limit thresholds (e.g., >10 failed attempts per minute per IP). Log aggregation and SIEM tools can correlate these signals to identify active exploitation attempts.

Why prioritize this

This vulnerability merits a medium priority in most environments. While the CVSS score is LOW and attack complexity is HIGH, the combination of network accessibility, public exploit availability, and the critical nature of authentication systems justifies elevation above the CVSS rating alone. Credential compromise, even with low probability, has outsized business impact. Organizations should patch within 60–90 days as part of normal update cycles, and sooner if droidclaw is customer-facing or guards sensitive data.

Risk score, explained

The CVSS v3.1 score of 3.7 reflects: (1) network-accessible attack surface (AV:N); (2) high attack complexity, limiting opportunistic exploitation (AC:H); (3) no authentication required (PR:N); (4) low confidentiality impact via information disclosure during credential guessing (C:L); and (5) no integrity or availability impact (I:N, A:N). The score is conservative and does not fully capture the reputational and operational risk of credential compromise. Security teams should interpret this score in context: a LOW CVSS for an authentication flaw warrants closer scrutiny than a LOW CVSS for a minor information leak.

Frequently asked questions