An unauthenticated remote attacker can forge Telnyx webhook events in OpenClaw due to improper signature verification, posing a significant risk to system integrity.

This vulnerability involves missing authentication for a critical function (CWE-306) within the Telnyx webhook handler. Specifically, the TelnyxProvider.verifyWebhook method fails to enforce signature validation when a public key is not configured, allowing unauthenticated attackers to submit arbitrary, forged events to the voice-call webhook endpoint.

The ability to forge webhook events allows an attacker to manipulate the AI assistant's voice call logic, potentially leading to unauthorized actions or service disruption. Given the CVSS score of 7.5, this high-severity vulnerability represents a significant risk to application integrity, particularly for deployments where the voice-call plugin is publicly exposed.

Immediate Action: Update the OpenClaw package to version 2026.2.14 or later to ensure proper Telnyx webhook signature verification is enforced.

Proactive Monitoring: Review application logs for unexpected or malformed webhook POST requests to the voice-call endpoint that do not contain valid Ed25519 signatures.

Compensating Controls: If an immediate update is not feasible, ensure the webhook endpoint is restricted via IP allowlisting or a Web Application Firewall to only accept traffic originating from authorized Telnyx infrastructure.

Public Exploit Available: Unknown

This vulnerability presents a clear risk to the integrity of voice-call processing in OpenClaw. Administrators should prioritize updating to version 2026.2.14 immediately to close this authentication bypass. Failure to patch allows attackers to spoof events, which could be leveraged to disrupt or manipulate the assistant's communication functions.