Replay Attack Affecting @openclaw/voice-call package, versions >=0.0.0
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-OPENCLAWVOICECALL-15865846
- published1 Apr 2026
- disclosed31 Mar 2026
- creditzsxsoft
Introduced: 31 Mar 2026
New CVE NOT AVAILABLE CWE-294 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
A fix was pushed into the master branch but not yet published.
Overview
@openclaw/voice-call is an OpenClaw voice-call plugin
Affected versions of this package are vulnerable to Replay Attack in the webhook-security.ts process. An attacker can bypass replay protection by capturing a valid signed webhook and resending it with reordered query parameters, thereby triggering duplicate processing of voice-call events.