CVE-2026-10216

Vulnerability

The vulnerability resides in the /pairing/claim endpoint of server/src/routes/pairing.ts in unitedbyai droidclaw up to version 0.5.3 [1]. The endpoint implements an IP-based rate limiter (isRateLimited()) to prevent brute-force attacks against 6-digit pairing codes. However, the IP address is extracted from the X-Forwarded-For or X-Real-IP HTTP headers, which are easily spoofed by an attacker [2][3]. This improper restriction of excessive authentication attempts allows an unauthenticated remote attacker to bypass the intended 5-attempts-per-minute limit.

Exploitation

An attacker can send requests to the /pairing/claim endpoint with a randomly generated X-Forwarded-For header for each request, making each attempt appear to come from a different IP address [2][3]. This bypasses the in-memory rate limiter, which keys on the spoofed IP. The attacker can then brute-force the entire 6-digit pairing code keyspace (900,000 possibilities) within minutes. No prior authentication or user interaction is required. The exploit is publicly available [2][3].

Impact

Upon successfully guessing a valid pairing code, the server returns the victim user's apiKey [2][3]. With this key, the attacker can connect to the WebSocket API and gain full control over the victim's device, effectively achieving device takeover. This compromises the confidentiality, integrity, and availability of the device and any data accessible through it.

Mitigation

As of the publication date, the project maintainer has not responded to the issue report [2][3]. No official fix or patched version has been released. Users are advised to disable the /pairing/claim endpoint or implement a more robust rate-limiting mechanism that does not rely on spoofable headers (e.g., using a session token or CAPTCHA). The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog.