Improper access control in OpenClaw - #VU125173
Published: April 8, 2026
Vulnerability identifier: #VU125173
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: N/A
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: OpenClaw
Affected software:
OpenClaw
OpenClaw
Detailed vulnerability description
The vulnerability allows a remote attacker to bypass replay protection.
The vulnerability exists due to improper access control in webhook-security.ts when verifying Plivo V2 signed requests with query-only URL variants. A remote attacker can send a signed request with modified query string parameters to bypass replay protection.
The issue arises because signature validation canonicalizes the base URL without query parameters, while the replay key is derived from the full verification URL including the query string.
Remediation
Install security update from vendor's website.