Event ·Multi-source

OpenClaw测试澳洲健身房预订API，零授权校验漏洞可取消他人预订

OpenClaw（运行Opus 4.6）对一家澳大利亚健身房预订网站的API进行安全测试，发现取消他人预订的接口没有授权校验。测试者与排位第1的候补者交互，实际成功取消了对方预订，使自己的名次从第4升至第3。该漏洞曝光了服务端对API调用方身份缺乏任何验证的问题。

Current read

OpenClaw用Opus 4.6实测澳洲健身房API，发现没权限校验，能把别人预订直接取消，还能让自己排队名次提前。安全测试就得这么硬核。

6 sources55° AI heatLast updated 2026/8/10 02:05:16

Evidence

6 sources

Primary sourceSimon Willison’s Weblog

2026/8/10 02:05:16View source

Related source 1IT之家

2026/8/10 00:35:49View source

Related source 2techcrunch

2026/8/10 20:04:24View source

Related source 3小互

2026/8/10 03:15:19View source

Related source 4Y Combinator

2026/8/10 21:21:39View source

Related source 5Yangyi

2026/8/10 21:46:29View source

Conflict check

Dedup data only shows that these sources discuss the same event, not that they agree. There is no structured supporting or refuting evidence yet, so no conflict is inferred automatically.

Open the story