GHSA-8689-gm9g-jgr6
OpenClaw: Voice-call Plivo V3 webhook replay key uses unsorted URL, allowing replay via query-parameter reordering
Packages
Details
As written in the advisory (Markdown source, shown as plain text).
## Summary
Plivo V3 signature verification canonicalized query ordering, but replay detection hashed the raw verification URL. Reordering query parameters preserved a valid signature while producing a fresh replay-cache key.
## Impact
An attacker who captured one valid signed Plivo V3 webhook could replay the same event by permuting query parameters and trigger duplicate voice-call processing.
## Affected Component
`extensions/voice-call/src/webhook-security.ts`
## Fixed Versions
- Affected: `<= 2026.3.24`
- Patched: `>= 2026.3.28`
- Latest stable `2026.3.28` contains the fix.
## Fix
Fixed by commit `85777e726c` (`Voice Call: canonicalize Plivo V3 replay key`).
References
External links from the advisory. They lead to third-party sites.