Is CVE-2026-16083 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-16083 being exploited in the wild.

How severe is CVE-2026-16083?

Medium severity, with a CVSS score of 5.3, published 18 July 2026.

Is there a fix for CVE-2026-16083?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-16083 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-16083?

Check whether you run Sipeed PicoClaw at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-16083: Sipeed PicoClaw auth bypass by capture-replay in LINE Webhook

CVE-2026-16083 · Severity: medium · CVSS 5.3 · Published 2026-07-18

Sipeed PicoClaw is an AI assistant framework designed for low-power hardware. A security flaw in its LINE messaging integration allows an attacker to resend previously captured messages, tricking the system into processing them multiple times. This can lead to duplicate automated actions, repeated financial costs for AI processing, and inconsistent data in connected workflows.

Technologies: Sipeed PicoClaw. Vendors: Sipeed.

Quick answers

Is CVE-2026-16083 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-16083 being exploited in the wild.
How severe is CVE-2026-16083?: Medium severity, with a CVSS score of 5.3, published 18 July 2026.
Which products and versions are affected?: Sipeed PicoClaw <= 0.2.9.
Is there a fix for CVE-2026-16083?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-16083 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-16083?: Check whether you run Sipeed PicoClaw at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An authentication bypass by capture-replay exists in the LINE Webhook component of Sipeed PicoClaw. The vulnerability is located in the `webhook.ParseRequest` function within `pkg/channels/line/line.go`. While the system correctly validates the HMAC signature of incoming LINE webhooks, it fails to implement replay suppression or idempotency checks using the stable `message.id` provided by the platform. A remote, unauthenticated attacker can capture a valid signed webhook and replay it to the `/webhook/line` endpoint, causing the application to republish the event to the internal message bus and execute downstream agent actions multiple times. As of the advisory date, the issue is marked as 'not planned' for fixing by the maintainers.

Affected products

Sipeed PicoClaw <= 0.2.9

Timeline

2026-07-18: disclosed: Vulnerability disclosed via GitHub issue and VulDB
2026-07-18: advisory: CVE-2026-16083 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.