Replay Attack Affecting @openclaw/voice-call package, versions >=0.0.0
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-OPENCLAWVOICECALL-15900046
- published5 Apr 2026
- disclosed2 Apr 2026
- creditUnknown
Introduced: 2 Apr 2026
New CVE NOT AVAILABLE CWE-294 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
A fix was pushed into the master branch but not yet published.
Overview
@openclaw/voice-call is an OpenClaw voice-call plugin
Affected versions of this package are vulnerable to Replay Attack in the callback process. An attacker can alter the origin of a Plivo callback before it is rejected by replaying a captured valid callback for a live call.