Skip to content
Fencer Intel
low 3.7

GHSA-gcj7-r3hg-m7w6 json

OpenClaw's voice-call Twilio replay dedupe now bound to authenticated webhook identity

published 8mo ago modified 8mo ago

cvss
3.7
version 3.1, GitHub
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

### Summary The voice-call Twilio webhook path accepted replay/dedupe identity from unsigned request metadata (`i-twilio-idempotency-token`), enabling replayed signed requests to bypass replay detection and manager dedupe by mutating only that header.

### Affected Packages / Versions - Package: `openclaw` (npm) - Affected versions: `<= 2026.2.25` (latest published npm version at triage time) - Fixed on `main`: commit `1aadf26f9acc399affabd859937a09468a9c5cb4` - Planned patched npm version: `2026.2.26`

### Impact Deployments using the optional `voice-call` Twilio webhook path could accept replayed webhook events as fresh events when an attacker had one valid signed request and changed only the unsigned idempotency header.

### Technical Details The fix removes unsigned-header trust from Twilio replay/dedupe identity and binds replay/manager dedupe to authenticated request material. It also threads a verified request identity through provider parsing so dedupe uses verification-derived identity rather than mutable headers.

### Fix Commit(s) - `1aadf26f9acc399affabd859937a09468a9c5cb4`

### Release Process Note `patched_versions` is pre-set to the planned next release (`2026.2.26`). After the npm release is published, this advisory can be published without additional version-field edits.

OpenClaw thanks @tdjackey for reporting.

Patch / fix

  • npm openclaw 2026.2.26

Is GHSA-gcj7-r3hg-m7w6 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CVSS scores

assigned by version score vector
GitHub 3.1 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected packages

ecosystem package affected fixed in
npm openclaw
<2026.2.26
2026.2.26

Classification

Weakness
  • CWE-294 Authentication Bypass by Capture-replay
  • CWE-345 Insufficient Verification of Data Authenticity

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

The maintainers of openclaw/openclaw published their own advisory on GitHub. Reviewed sources take precedence over it.