| Package | Affected versions | Patched versions |
|---|---|---|
| openclaw | < 2026.3.28 | 2026.3.28 |
| openclaw | < 2026.3.28 | 2026.3.28 |
Plivo V3 signature verification canonicalized query ordering, but replay detection hashed the raw verification URL. Reordering query parameters preserved a valid signature while producing a fresh replay-cache key.
An attacker who captured one valid signed Plivo V3 webhook could replay the same event by permuting query parameters and trigger duplicate voice-call processing.
extensions/voice-call/src/webhook-security.ts
<= 2026.3.24>= 2026.3.282026.3.28 contains the fix.Fixed by commit 85777e726c (Voice Call: canonicalize Plivo V3 replay key).
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free