GitHub Advisoryadvisory · npm

GHSA-8689-gm9g-jgr6 OpenClaw: Voice-call Plivo V3 webhook replay key uses unsorted URL, allowing replay via query-parameter reordering

HIGH Published 2026-03-31 Modified 2026-04-28 Official page ↗
Aliases
CVE-2026-41395
Ecosystem
npm
Packages
openclaw
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-294
Reviewed
2026-03-31

Affected packages

• npm openclaw: < 2026.3.28 → fixed in 2026.3.28

Description

Summary Plivo V3 signature verification canonicalized query ordering, but replay detection hashed the raw verification URL. Reordering query parameters preserved a valid signature while producing a fresh replay-cache key. Impact An attacker who captured one valid signed Plivo V3 webhook could replay the same event by permuting query parameters and trigger duplicate voice-call processing. Affected Component `extensions/voice-call/src/webhook-security.ts` Fixed Versions • Affected: `= 2026.3.28` • Latest stable `2026.3.28` contains the fix. Fix Fixed by commit `85777e726c` (`Voice Call: canonicalize Plivo V3 replay key`).

Related

Alias · CVE (1)

  • CVE-2026-41395 OpenClaw before 2026.3.28 contains a webhook replay vulnerability in Plivo V3 signature verification that canonicalizes query ordering for… vulnerability

Weakness · CWE (1)

  • CWE-294 Authentication Bypass by Capture-replay weakness

References