Replay Identity Vulnerability in OpenClaw Package: Bypass of Plivo V2 Signature Verification
Summary
GHSA-j56c-wpqm-h24x: Duplicate Advisory: OpenClaw: Plivo V2 verified replay identity drifts on query-only variants. Affects openclaw versions < 2026.3.23. Fixed in 2026.3.23. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenClaw is an open-source library designed for building applications that require communication capabilities, such as messaging and voice calls. It integrates with various communication platforms, including Plivo, to facilitate these functionalities. The library's reliance on secure signature verification is crucial for maintaining the integrity and authenticity of requests. However, a vulnerability has been identified that compromises this security feature, allowing attackers to manipulate query parameters and bypass replay protection.
Vulnerability Detail
The vulnerability in OpenClaw arises from its handling of Plivo V2 signature verification, which allows attackers to exploit the system by modifying query parameters in requests. Instead of deriving replay keys from a canonicalized base URL, the verification process uses the full URL, including query strings. This flaw enables attackers to create new verified request keys through unsigned changes to signed requests, potentially leading to unauthorized access and actions within the application. The severity of this vulnerability is rated as HIGH, with a CVSS score of 6.5, indicating significant risk to affected systems.
How To Fix
Latest published version: 2026.10.6 as of 22 Oct 2026
npm install openclaw@2026.10.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2026.3.23
This is the first release that contains the fix.
npm install openclaw@2026.3.23Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing additional validation checks on query parameters to ensure that any modifications do not affect the integrity of the requests. However, this is not a substitute for applying the official patch.
Conclusion
The replay identity vulnerability in OpenClaw poses a significant risk to applications relying on Plivo V2 signature verification. By understanding the nature of this vulnerability and taking the necessary steps to update the package, developers can protect their applications from potential exploitation. Utilizing tools like Vulert can further enhance security by providing real-time monitoring for open-source vulnerabilities.
See every vulnerability recorded for openclaw →
FAQ
The vulnerability allows attackers to bypass replay protection by modifying query parameters in signed requests, leading to potential unauthorized actions.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By checking your package-lock.json file, you can identify if your application is at risk.
It is recommended to update to version 2026.3.23 or later to mitigate the vulnerability.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Failure to address this vulnerability could lead to unauthorized access and actions within your application, compromising user data and application integrity.
References
Related vulnerabilities
Recent vulnerabilities recorded for openclaw.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.