#VU125173 Improper access control in OpenClaw
Published: April 8, 2026
Vulnerability identifier: #VU125173
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: N/A
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
OpenClaw
OpenClaw
Software vendor:
OpenClaw
OpenClaw
Description
The vulnerability allows a remote attacker to bypass replay protection.
The vulnerability exists due to improper access control in webhook-security.ts when verifying Plivo V2 signed requests with query-only URL variants. A remote attacker can send a signed request with modified query string parameters to bypass replay protection.
The issue arises because signature validation canonicalizes the base URL without query parameters, while the replay key is derived from the full verification URL including the query string.
Remediation
Install security update from vendor's website.