N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-37v6-fxx8-xjmx

GHSA-37v6-fxx8-xjmx: OpenClaw: Telnyx Webhook Replay Detection Bypass via Base64 Signature Re-encoding

Summary

Telnyx Webhook Replay Detection Bypass via Base64 Signature Re-encoding

Current Maintainer Triage

Status: narrow
Normalized severity: low
Assessment: Shipped v2026.3.28 replay hashing treated equivalent Telnyx Base64/Base64URL signatures as distinct requests, but signature verification still held, so lower to low.

Affected Packages / Versions

Package: openclaw (npm)
Latest published npm version: 2026.3.31
Vulnerable version range: <=2026.3.28
Patched versions: >= 2026.3.31
First stable tag containing the fix: v2026.3.31

Fix Commit(s)

ad77666054651c1fd77b1dc60fd6a8db6600a29a — 2026-03-30T20:01:43+01:00

Release Process Note

The fix is already present in released version 2026.3.31.
This draft looks ready for final maintainer disposition or publication, not additional code-fix work.

OpenClaw thanks @AntAISecurityLab for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-37v6-fxx8-xjmx

GHSA-37v6-fxx8-xjmx:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	<= 2026.3.28	2026.3.31

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the provided patch commit ad77666054651c1fd77b1dc60fd6a8db6600a29a reveals a vulnerability in the Telnyx webhook signature verification logic. The root cause of the vulnerability lies in the verifyTelnyxWebhook function within the file extensions/voice-call/src/webhook-security.ts. Previously, the function calculated a replayKey for detecting replay attacks using the raw signature string received in the HTTP request. However, the signature could be represented in different but equivalent Base64 encodings (standard Base64 and Base64URL). An attacker could exploit this by submitting the same valid webhook request multiple times, each time with a different encoding of the same signature. This would result in different replayKey values, allowing the duplicated requests to bypass the replay detection. The patch addresses this by introducing a canonicalization step. It now decodes the signature, regardless of its original Base64 variant, and then re-encodes it to a consistent, canonical Base64 representation before generating the replayKey. This ensures that any request with a cryptographically identical signature will produce the same replay key, effectively preventing the bypass. Therefore, the verifyTelnyxWebhook function is the direct location of the vulnerability.

Vulnerable functions

verifyTelnyxWebhook

extensions/voice-call/src/webhook-security.ts

The function `verifyTelnyxWebhook` was vulnerable to a replay attack. It generated a replay detection key using the raw `signature` provided in the webhook request. An attacker could re-encode the signature (e.g., from standard Base64 to Base64URL) and resubmit the same request. While the signature would still be cryptographically valid, the different encoding would produce a different replay key, thus bypassing the replay protection mechanism. The patch fixes this by canonicalizing the signature to a standard Base64 encoding before generating the replay key.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.