Home

Description

OpenClaw before 2026.3.28 contains a webhook replay vulnerability in Plivo V3 signature verification that canonicalizes query ordering for signatures but hashes raw URLs for replay detection. Attackers can reorder query parameters to bypass replay cache detection and trigger duplicate voice-call processing with a captured valid signed webhook.

PUBLISHED Reserved 2026-04-20 | Published 2026-04-28 | Updated 2026-04-29 | Assigner VulnCheck




HIGH: 8.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

HIGH: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Problem types

CWE-325: Missing Cryptographic Step

Product status

Default status
unaffected

Any version before 2026.3.28
affected

2026.3.28 (semver)
unaffected

Credits

zsx (@zsxsoft) reporter

KeenSecurityLab finder

References

github.com/...enclaw/security/advisories/GHSA-8689-gm9g-jgr6 (GitHub Security Advisory (GHSA-8689-gm9g-jgr6)) vendor-advisory

www.vulncheck.com/...-query-parameter-reordering-in-plivo-v3 (VulnCheck Advisory: OpenClaw < 2026.3.28 - Webhook Replay via Query Parameter Reordering in Plivo V3) third-party-advisory

cve.org (CVE-2026-41395)

nvd.nist.gov (CVE-2026-41395)

Download JSON