Junglewise Threat Intelligence

CVE-2026-41351: OpenClaw Telnyx webhook replay detection bypass

CVE-2026-41351 · Severity: low · CVSS 3.1 · Published 2026-04-03

Technologies: Openclaw. Vendors: Openclaw.

Executive brief

OpenClaw is a software framework that handles webhook integrations with Telnyx, a telecommunications API provider. The vulnerability allows an attacker to replay previously sent webhook messages by re-encoding the signature in a different Base64 format, bypassing built-in replay detection mechanisms while the signature still validates correctly. Although the flaw permits message replay, it does not compromise signature verification itself, limiting exposure to scenarios where repeated webhook events could cause undesired side effects.

Technical details

The vulnerability is a capture-replay authentication bypass (CWE-294) in OpenClaw's Telnyx webhook handling. The root cause is that the replay detection mechanism treats Base64-encoded and Base64URL-encoded versions of the same signature as distinct requests, even though they represent identical cryptographic material. An attacker can intercept a valid Telnyx webhook, re-encode its signature using Base64URL instead of Base64 (or vice versa), and resend it to trigger the webhook handler again. Although the signature verification step correctly validates both encoding variants, the replay cache treats them as separate, allowing the same event to be processed multiple times. The fix (commit ad77666, released in v2026.3.31) canonicalizes signature encoding before replay checking. Affected versions are <=2026.3.28; patched in 2026.3.31 and later.

Affected products

  • OpenClaw OpenClaw <=2026.3.28

Timeline

  • 2026-04-03: disclosed
  • 2026-03-30: patched: Fix commit ad77666
  • 2026-04-03: advisory: GitHub advisory published

References

Related threats