An unauthenticated webhook replay vulnerability in OpenClaw allows attackers to bypass security checks and trigger unauthorized duplicate voice-call processing.

The application incorrectly canonicalizes query parameters during signature verification for Plivo V3 webhooks while hashing raw URLs for replay detection, allowing an unauthenticated attacker to reorder parameters and bypass the replay cache.

This vulnerability poses a significant risk to the integrity of voice-call processing workflows. Successful exploitation allows for the unauthorized triggering of duplicate calls, which can lead to service exhaustion, financial loss from fraudulent call charges, and disruption of legitimate business communications. With a CVSS score of 7.5, the issue is classified as High severity due to the potential for automated abuse.

Immediate Action: Update the OpenClaw package to version 2026.3.28 or later to incorporate the correct canonicalization logic for webhook signature verification.

Proactive Monitoring: Review application logs for anomalous patterns of duplicate webhook requests or high-frequency triggers originating from identical source payloads.

Compensating Controls: Implement strict rate limiting on webhook processing endpoints and ensure that backend services perform stateful checks to identify and discard duplicate request identifiers.

Public Exploit Available: No — there is no confirmed public exploit or weaponized code available in the provided data.

The risk posed by this replay vulnerability is substantial for any organization relying on Plivo V3 webhooks for voice infrastructure. IT and security teams should prioritize upgrading to version 2026.3.28 immediately to ensure that webhook integrity checks cannot be bypassed. Failure to patch allows for potential service abuse and unauthorized call execution that could impact both operational costs and system availability.