PT-2026-32065 · Npm · Openclaw

Published 2026-03-31 · Updated 2026-03-31

OSV

CVSS v4.0

8.2

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Summary

Plivo V3 signature verification canonicalized query ordering, but replay detection hashed the raw verification URL. Reordering query parameters preserved a valid signature while producing a fresh replay-cache key.

Impact

An attacker who captured one valid signed Plivo V3 webhook could replay the same event by permuting query parameters and trigger duplicate voice-call processing.

Affected Component

extensions/voice-call/src/webhook-security.ts

Fixed Versions

• Affected: <= 2026.3.24
• Patched: >= 2026.3.28
• Latest stable 2026.3.28 contains the fix.

Fix

Fixed by commit 85777e726c (Voice Call: canonicalize Plivo V3 replay key).

Fix

Weakness Enumeration

CWE-294

Related Identifiers

GHSA-8689-GM9G-JGR6

Affected Products

Openclaw

References · 4

• https://osv.dev/vulnerability/GHSA-8689-gm9g-jgr6 · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/security/advisories/GHSA-8689-gm9g-jgr6 · Note
• https://github.com/openclaw/openclaw/commit/85777e726cb02c01a911b3ff832ddf4d664d5c94 · Note