Authentication Bypass by Capture-replay in OpenClaw - CVE-2026-41351
Published: April 30, 2026
Vulnerability identifier: #VU128605
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-41351
CWE-ID: CWE-294
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to bypass replay detection.
The vulnerability exists due to authentication bypass by capture-replay in the Telnyx webhook replay detection logic when processing Telnyx webhook signatures re-encoded between Base64 and Base64URL forms. A remote user can resend a captured webhook with a re-encoded signature to bypass replay detection.
Signature verification still holds, and the issue is limited to replay detection treating equivalent signature encodings as distinct requests.
Affected software
OpenClaw
How to mitigate CVE-2026-41351
Install security update from vendor's website.
OpenClaw - update to 2026.3.31