GitHub Advisoryadvisory · npm

GHSA-vqx8-9xxw-f2m7 OpenClaw's voice-call Twilio webhook replay could bypass manager dedupe because normalized event IDs were randomized per parse

MEDIUM Published 2026-03-03 Modified 2026-03-30 Official page ↗
Aliases
CVE-2026-32053
Ecosystem
npm
Packages
openclaw
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Weaknesses
CWE-294, CWE-863
Reviewed
2026-03-03

Affected packages

• npm openclaw: < 2026.2.23 → fixed in 2026.2.23

Description

Impact Twilio webhook replay events could bypass voice-call manager dedupe because normalized event IDs were randomized per parse. A replayed event could be treated as new and trigger duplicate or stale call-state transitions. Affected Packages / Versions • Package: `openclaw` (npm) • Vulnerable versions: `= 2026.2.23` Remediation The fix preserves provider event IDs through normalization, adds bounded replay dedupe in webhook security validation, and enforces per-call turn-token checks on call-state transitions. Fix Commit(s) • 1d28da55a5d0ff409e34999e0961157e9db0a2ab Release Process Note `patched_versions` is pre-set to the released version (`2026.2.23`) This advisory now reflects released fix version `2026.2.23`.2.23`. OpenClaw thanks @jiseoung for reporting.

Related

Alias · CVE (1)

  • CVE-2026-32053 OpenClaw versions prior to 2026.2.23 contain a vulnerability in Twilio webhook event deduplication where normalized event IDs are… vulnerability

Weakness · CWE (2)

  • CWE-294 Authentication Bypass by Capture-replay weakness
  • CWE-863 Incorrect Authorization weakness

References