Replay Attack Affecting @openclaw/voice-call package, versions >=0.0.0
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-OPENCLAWVOICECALL-15789446
- published27 Mar 2026
- disclosed26 Mar 2026
- creditsmaeljaish771
Introduced: 26 Mar 2026
New CVE NOT AVAILABLE CWE-294 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
A fix was pushed into the master branch but not yet published.
Overview
@openclaw/voice-call is an OpenClaw voice-call plugin
Affected versions of this package are vulnerable to Replay Attack due to improper derivation of the replay key in the webhook-security.ts process. An attacker can bypass replay protection and submit multiple authenticated requests by modifying the query string of the verification URL without altering the signature.