GHSA-8689-gm9g-jgr6High

OpenClaw: Voice-call Plivo V3 webhook replay key uses unsorted URL, allowing replay via query-parameter reordering

Published
March 31, 2026
Last Modified
April 28, 2026

🔗 CVE IDs covered (1)

CVE-2026-41395 →

📋 Description

Summary

Plivo V3 signature verification canonicalized query ordering, but replay detection hashed the raw verification URL. Reordering query parameters preserved a valid signature while producing a fresh replay-cache key.

Impact

An attacker who captured one valid signed Plivo V3 webhook could replay the same event by permuting query parameters and trigger duplicate voice-call processing.

Affected Component

extensions/voice-call/src/webhook-security.ts

Fixed Versions

  • Affected: <= 2026.3.24
  • Patched: >= 2026.3.28
  • Latest stable 2026.3.28 contains the fix.

Fix

Fixed by commit 85777e726c (Voice Call: canonicalize Plivo V3 replay key).

🎯 Affected products1

  • npm/openclaw:< 2026.3.28

🔗 References (3)