https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-28T13:55:43.444189+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-41395 CVE-2026-41395 — OpenClaw < 2026.3.28 - Webhook Replay via Query Parameter Reordering in Plivo V3 2026-09-28T13:55:43.465741+00:00

Affected: OpenClaw

OpenClaw before 2026.3.28 contains a webhook replay vulnerability in Plivo V3 signature verification that canonicalizes query ordering for signatures but hashes raw URLs for replay detection. Attackers can reorder query parameters to bypass replay cache detection and trigger duplicate voice-call processing with a captured valid signed webhook.

 https://vulnerability.circl.lu/vuln/ghsa-8689-gm9g-jgr6 GHSA-8689-gm9g-jgr6 — OpenClaw: Voice-call Plivo V3 webhook replay key uses unsorted URL, allowing replay via query-parameter reordering 2026-09-28T13:55:43.465872+00:00

Affected: npm: openclaw

## Summary

Plivo V3 signature verification canonicalized query ordering, but replay detection hashed the raw verification URL. Reordering query parameters preserved a valid signature while producing a fresh replay-cache key.

## Impact

An attacker who captured one valid signed Plivo V3 webhook could replay the same event by permuting query parameters and trigger duplicate voice-call processing.

## Affected Component

`extensions/voice-call/src/webhook-security.ts`

## Fixed Versions

- Affected: `<= 2026.3.24` - Patched: `>= 2026.3.28` - Latest stable `2026.3.28` contains the fix.

## Fix

Fixed by commit `85777e726c` (`Voice Call: canonicalize Plivo V3 replay key`).