Executive brief
OpenClaw's voice-call service uses Plivo webhooks to process incoming calls. The system verifies webhook signatures but failed to canonicalize the URL before hashing for replay detection, allowing attackers to reorder query parameters to bypass replay protection and trigger duplicate call processing without valid authorization.
Technical details
OpenClaw's voice-call webhook handler (extensions/voice-call/src/webhook-security.ts) canonicalized query parameter ordering for signature verification but used the raw, unsorted URL when computing the replay-detection cache key (CWE-294: Improper Use of Cryptographic Primitive). An attacker who intercepts a valid Plivo V3 webhook can permute the query parameters, which preserves the valid HMAC signature (because verification canonicalizes order) while generating a new replay-cache key, bypassing duplicate-event detection. The attack requires network access to observe a legitimate webhook and no privileges; it results in duplicate voice-call processing. Fixed in version 2026.3.28 via commit 85777e726c, which canonicalizes the replay key before hashing.
Affected products
- OpenClaw openclaw <=2026.3.24
Timeline
- 2026-03-31: disclosed
- 2026-03-28: patched: Version 2026.3.28 contains the fix