Incorrect Authorization Affecting @openclaw/voice-call package, versions <2026.2.23
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-OPENCLAWVOICECALL-15372816
- published4 Mar 2026
- disclosed3 Mar 2026
- creditJisung
Introduced: 3 Mar 2026
New CVE NOT AVAILABLE CWE-294 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade @openclaw/voice-call to version 2026.2.23 or higher.
Overview
@openclaw/voice-call is an OpenClaw voice-call plugin
Affected versions of this package are vulnerable to Incorrect Authorization via the webhook event deduplication. An attacker can trigger duplicate or stale call-state transitions by replaying Twilio webhook events with randomized event IDs.