https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 18:06:17 +0000 https://vulnerability.circl.lu/vuln/cve-2026-41395 <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw before 2026.3.28 contains a webhook replay vulnerability in Plivo V3 signature verification that canonicalizes query ordering for signatures but hashes raw URLs for replay detection. Attackers can reorder query parameters to bypass replay cache detection and trigger duplicate voice-call processing with a captured valid signed webhook.</p> <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw before 2026.3.28 contains a webhook replay vulnerability in Plivo V3 signature verification that canonicalizes query ordering for signatures but hashes raw URLs for replay detection. Attackers can reorder query parameters to bypass replay cache detection and trigger duplicate voice-call processing with a captured valid signed webhook.</p> https://vulnerability.circl.lu/vuln/cve-2026-41395 https://vulnerability.circl.lu/vuln/ghsa-8689-gm9g-jgr6 <p><strong>Affected:</strong> npm: openclaw</p> <p>## Summary</p> <p>Plivo V3 signature verification canonicalized query ordering, but replay detection hashed the raw verification URL. Reordering query parameters preserved a valid signature while producing a fresh replay-cache key.</p> <p>## Impact</p> <p>An attacker who captured one valid signed Plivo V3 webhook could replay the same event by permuting query parameters and trigger duplicate voice-call processing.</p> <p>## Affected Component</p> <p>`extensions/voice-call/src/webhook-security.ts`</p> <p>## Fixed Versions</p> <p>- Affected: `&lt;= 2026.3.24` - Patched: `&gt;= 2026.3.28` - Latest stable `2026.3.28` contains the fix.</p> <p>## Fix</p> <p>Fixed by commit `85777e726c` (`Voice Call: canonicalize Plivo V3 replay key`).</p> <p><strong>Affected:</strong> npm: openclaw</p> <p>## Summary</p> <p>Plivo V3 signature verification canonicalized query ordering, but replay detection hashed the raw verification URL. Reordering query parameters preserved a valid signature while producing a fresh replay-cache key.</p> <p>## Impact</p> <p>An attacker who captured one valid signed Plivo V3 webhook could replay the same event by permuting query parameters and trigger duplicate voice-call processing.</p> <p>## Affected Component</p> <p>`extensions/voice-call/src/webhook-security.ts`</p> <p>## Fixed Versions</p> <p>- Affected: `&lt;= 2026.3.24` - Patched: `&gt;= 2026.3.28` - Latest stable `2026.3.28` contains the fix.</p> <p>## Fix</p> <p>Fixed by commit `85777e726c` (`Voice Call: canonicalize Plivo V3 replay key`).</p> https://vulnerability.circl.lu/vuln/ghsa-8689-gm9g-jgr6