Executive brief
OpenClaw is a Node.js library for handling Telnyx webhooks. The library failed to normalize webhook signatures before replay detection, allowing attackers to re-encode valid signatures using different Base64 variants to bypass replay protections while maintaining signature validity. This could enable attackers to replay Telnyx webhook events multiple times.
Technical details
OpenClaw versions prior to 2026.3.31 contain a replay detection bypass vulnerability (CWE-294) in the webhook signature handling logic. The replay detection mechanism treated Base64 and Base64URL encoded signatures as distinct requests, even though both decode to the same signature bytes. An attacker with network access can intercept a valid Telnyx webhook signature, re-encode it using an alternative Base64 variant, and replay the modified signature to bypass the replay detection while passing signature verification. The vulnerability requires network access but no authentication; the fix is available in version 2026.3.31 and later.
Affected products
- OpenClaw OpenClaw <=2026.3.28
Timeline
- 2026-03-31: disclosed
- 2026-03-31: patched: v2026.3.31 released with fix
- 2026-04-24: advisory: GHSA-m958-864j-xq5w published, later withdrawn as duplicate of GHSA-37v6-fxx8-xjmx