OpenClaw versions prior to 2026.2.14 contain a webhook routing vulnerability in the Google Chat monitor component. The vulnerability allows cross-account policy context misrouting when multiple webhook targets share the same HTTP path. Attackers can exploit first-match request verification semantics to process inbound webhook events under incorrect account contexts. This bypasses intended allowlists and session policies, potentially leading to unauthorized access. The vulnerability affects the authentication and authorization mechanisms of the application.