Executive brief
OpenClaw is a JavaScript library for managing voice-call callbacks via Plivo, a cloud communications platform. A vulnerability allows the callback origin to be mutated before replay rejection, potentially allowing an attacker with a captured valid callback from a live call to inject malicious data that bypasses security checks. This could compromise the integrity of voice-call transaction verification.
Technical details
The vulnerability (CWE-294: Improper Authentication) exists in the Plivo voice-call replay validation logic. The affected code mutates the in-process callback origin before replay rejection is evaluated, meaning an attacker who possesses a valid captured callback from a legitimate call can modify the origin field and have it processed before the replay detection mechanism validates it. This requires obtaining a valid callback from an active call, which limits exposure. The attack is network-reachable with no authentication required. The fix is available in OpenClaw version 2026.3.31 and later.
Affected products
- OpenClaw openclaw <=2026.3.28
Timeline
- 2026-04-02: disclosed
- 2026-03-31: patched: Fix commit efe9183f9d2fd5e01c8068fa01f4a07a58a63c0b; patched version 2026.3.31