PT-2026-20351 · Openclaw+1 · Openclaw+2
P80N-Sec
·
Published
2026-02-17
·
Updated
2026-02-20
·
CVE-2026-26319
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
OpenClaw versions prior to 2026.2.14
Description
The OpenClaw software, when using the
@openclaw/voice-call plugin, is susceptible to an authentication bypass. Specifically, the Telnyx webhook handler could accept unsigned inbound webhook requests if the telnyx.publicKey configuration was not set. This allows unauthenticated callers to potentially forge Telnyx events. The issue occurs because the TelnyxProvider.verifyWebhook() function could fail open when no Telnyx public key was configured, treating arbitrary HTTP POST requests as legitimate Telnyx events. The vulnerability is present only when the Voice Call plugin is installed, enabled, and the webhook endpoint is reachable from an attacker. A signature verification bypass exists only for local development via skipSignatureVerification: true, which is off by default and emits a warning.Recommendations
Configure
plugins.entries.voice-call.config.telnyx.publicKey (or TELNYX PUBLIC KEY) to enable signature verification.Exploit
Fix
Missing Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
@Openclaw/Voice-Call
Openclaw
Telnyx