GHSA-gcj7-r3hg-m7w6: Openclaw OpenClaw's Voice-call Twilio Replay Dedupe Vulnerability

LOW
Share
CVSS 3.7
CWE-294 CWE-345
Published
Advisory Summary

GHSA-gcj7-r3hg-m7w6 is a LOW (CVSS 3.7) openclaw's voice-call twilio replay dedupe vulnerability (CWE-294: Authentication Bypass by Capture-replay) affecting Openclaw libraries in the npm ecosystem. The issue involves openclaw's voice-call twilio replay dedupe now bound to authenticated webhook identity. Remediation is available by upgrading affected packages to version 2026.2.26.

GHSA-gcj7-r3hg-m7w6 at a Glance

CVE Identifier N/A
GHSA Identifier GHSA-gcj7-r3hg-m7w6
Severity LOW
CVSS v3.1 Base Score 3.7
CWE Classification CWE-294: Authentication Bypass by Capture-replay
Affected Product Openclaw
Package Ecosystem npm
Published Date
Last Updated

Security Impact

CVSS: 3.7

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).

Attack Vector Network (AV:N)
Attack Complexity High (AC:H)
Privileges Required None (PR:N)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality None (C:N)
Integrity None (I:N)
Availability Low (A:L)

How to Fix GHSA-gcj7-r3hg-m7w6

To remediate this vulnerability, upgrade all affected Openclaw dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

openclaw fixed: 2026.2.26 
npm install openclaw@2026.2.26
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

npm ls openclaw

How to Check if You Are Affected

To determine whether your Node.js application is affected by GHSA-gcj7-r3hg-m7w6, inspect your project dependencies using npm:

npm ls openclaw

Analyze the terminal output to locate any version of Openclaw in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 2026.2.26), your application is affected.

Note: The npm ls openclaw command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-294: Authentication Bypass by Capture-replay, where a capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes). In Openclaw, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Summary The voice-call Twilio webhook path accepted replay/dedupe identity from unsigned request metadata (`i-twilio-idempotency-token`), enabling replayed signed requests to bypass replay detection and manager dedupe by mutating only that header. ### Affected Packages / Versions - Package: `openclaw` (npm) - Affected versions: `<= 2026.2.25` (latest published npm version at triage time) - Fixed on `main`: commit `1aadf26f9acc399affabd859937a09468a9c5cb4` - Planned patched npm version: `2026.2.26` ### Impact Deployments using the optional `voice-call` Twilio webhook path could accept replayed webhook events as fresh events when an attacker had one valid signed request and changed only the unsigned idempotency header. ### Technical Details The fix removes unsigned-header trust from Twilio replay/dedupe identity and binds replay/manager dedupe to authenticated request material. It also threads a verified request identity through provider parsing so dedupe uses verification-derived identity rather than mutable headers. ### Fix Commit(s) - `1aadf26f9acc399affabd859937a09468a9c5cb4` ### Release Process Note `patched_versions` is pre-set to the planned next release (`2026.2.26`). After the npm release is published, this advisory can be published without additional version-field edits. OpenClaw thanks @tdjackey for reporting.

GHSA-gcj7-r3hg-m7w6 Affected Openclaw Versions

1 component(s)
Fixed Versions:
2026.2.26
Product / Package Ecosystem Affected Versions Fixed Version
openclaw
npm/openclaw
npm
< 2026.2.26
2026.2.26

References

GitHub Advisory / Wiki ADVISORY
https://github.com/openclaw/openclaw/security/advisories/GHSA-gcj7-r3hg-m7w6
Security Fix Commit FIX COMMIT
https://github.com/openclaw/openclaw/commit/1aadf26f9acc399affabd859937a09468a9c5cb4
Openclaw Source Repository REPOSITORY
https://github.com/openclaw/openclaw

Frequently Asked Questions

What is GHSA-gcj7-r3hg-m7w6?
GHSA-gcj7-r3hg-m7w6 is a security vulnerability in Openclaw involving OpenClaw's voice-call Twilio replay dedupe now bound to authenticated webhook identity under CWE-294: Authentication Bypass by Capture-replay.
Which Openclaw versions are affected?
Affected versions include releases prior to 2026.2.26 across affected packages: openclaw.
What version fixes GHSA-gcj7-r3hg-m7w6?
Upgrading to 2026.2.26 (or the latest patched release for your respective branch) resolves the vulnerability.
Is openclaw affected?
Yes, openclaw is affected in releases prior to 2026.2.26. Upgrade your dependency to 2026.2.26 or later.
What is the CVSS score of GHSA-gcj7-r3hg-m7w6?
GHSA-gcj7-r3hg-m7w6 has a CVSS v3.1 base score of 3.7 (LOW) with vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L.
What CWE is associated with GHSA-gcj7-r3hg-m7w6?
GHSA-gcj7-r3hg-m7w6 is classified under CWE-294: Authentication Bypass by Capture-replay (A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).).
How can I check npm dependencies for GHSA-gcj7-r3hg-m7w6?
Run the dependency tree command: 'npm ls openclaw'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-gcj7-r3hg-m7w6",
  "modified" : "2026-03-03T22:25:37Z",
  "published" : "2026-03-03T22:25:37Z",
  "aliases" : [ ],
  "summary" : "OpenClaw's voice-call Twilio replay dedupe now bound to authenticated webhook identity",
  "details" : "### Summary\nThe voice-call Twilio webhook path accepted replay/dedupe identity from unsigned request metadata (`i-twilio-idempotency-token`), enabling replayed signed requests to bypass replay detection and manager dedupe by mutating only that header.\n\n### Affected Packages / Versions\n- Package: `openclaw` (npm)\n- Affected versions: `<= 2026.2.25` (latest published npm version at triage time)\n- Fixed on `main`: commit `1aadf26f9acc399affabd859937a09468a9c5cb4`\n- Planned patched npm version: `2026.2.26`\n\n### Impact\nDeployments using the optional `voice-call` Twilio webhook path could accept replayed webhook events as fresh events when an attacker had one valid signed request and changed only the unsigned idempotency header.\n\n### Technical Details\nThe fix removes unsigned-header trust from Twilio replay/dedupe identity and binds replay/manager dedupe to authenticated request material. It also threads a verified request identity through provider parsing so dedupe uses verification-derived identity rather than mutable headers.\n\n### Fix Commit(s)\n- `1aadf26f9acc399affabd859937a09468a9c5cb4`\n\n### Release Process Note\n`patched_versions` is pre-set to the planned next release (`2026.2.26`). After the npm release is published, this advisory can be published without additional version-field edits.\n\nOpenClaw thanks @tdjackey for reporting.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "openclaw"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2026.2.26"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 2026.2.25"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/openclaw/openclaw/security/advisories/GHSA-gcj7-r3hg-m7w6"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/openclaw/openclaw/commit/1aadf26f9acc399affabd859937a09468a9c5cb4"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/openclaw/openclaw"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-294", "CWE-345" ],
    "severity" : "LOW",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-03-03T22:25:37Z",
    "nvd_published_at" : null
  }
}