5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-3m3q-x3gj-f79x

GHSA-3m3q-x3gj-f79x: OpenClaw optional voice-call plugin: webhook verification may be bypassed behind certain proxy configurations

Affected Packages / Versions

This issue affects the optional voice-call plugin only. It is not enabled by default; it only applies to installations where the plugin is installed and enabled.

Package: @openclaw/voice-call
Vulnerable versions: < 2026.2.3
Patched versions: >= 2026.2.3

Legacy package name (if you are still using it):

Package: @clawdbot/voice-call
Vulnerable versions: <= 2026.1.24
Patched versions: none published under this package name; migrate to @openclaw/voice-call

Summary

In certain reverse-proxy / forwarding setups, webhook verification can be bypassed if untrusted forwarded headers are accepted.

Impact

An external party may be able to send voice-call webhook requests that are accepted as valid, which can result in spoofed webhook events being processed.

Root Cause

Some deployments implicitly trusted forwarded headers (for example Forwarded / X-Forwarded-*) when determining request properties used during webhook verification. If those headers are not overwritten by a trusted proxy, a client can supply them directly and influence verification.

Resolution

Ignore forwarded headers by default unless explicitly trusted and allowlisted in configuration. Keep any loopback-only development bypass restricted to local development only. Upgrade to a patched version.

If you cannot upgrade immediately, strip Forwarded and X-Forwarded-* headers at the edge so clients cannot supply them directly.

Fix Commit(s)

a749db9820eb6d6224032a5a34223d286d2dcc2f

Credits

Thanks @0x5t for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-3m3q-x3gj-f79x

GHSA-3m3q-x3gj-f79x:

5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@openclaw/voice-call	npm	< 2026.2.3	2026.2.3
@clawdbot/voice-call	npm	<= 2026.1.24

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a webhook verification bypass in the OpenClaw voice-call plugin, caused by an implicit trust of HTTP forwarding headers like X-Forwarded-Host. An attacker could send a webhook request with a crafted X-Forwarded-Host header, which would cause the application to use an attacker-controlled URL for signature validation, thereby bypassing the security check.

The root of the vulnerability lies in the reconstructWebhookUrl function (located in extensions/voice-call/src/webhook-security.ts), which, prior to the patch, would read the host from headers like x-forwarded-host without any validation.

This vulnerable function was utilized by the webhook verification functions for the supported providers:

verifyPlivoWebhook (for Plivo)
verifyTwilioWebhook (for Twilio)

These verification functions are triggered by their respective webhook handlers, which act as the entry points for an exploit:

PlivoProvider.handleWebhook
TwilioProvider.handleWebhook (which in turn calls verifyTwilioProviderWebhook)

The patch rectifies this issue by introducing a webhookSecurity configuration that requires administrators to explicitly allowlist trusted hosts or proxy IPs. The reconstructWebhookUrl function was consequently updated to leverage this configuration to validate the host from forwarded headers before use, and the calls to it were updated to pass the new security options. A runtime profile during exploitation would reveal a call stack that includes the provider's webhook handler, the corresponding verification function, and ultimately the reconstructWebhookUrl function.

Vulnerable functions

reconstructWebhookUrl

extensions/voice-call/src/webhook-security.ts

This function was the root cause of the vulnerability. It reconstructed the webhook URL for signature verification and unconditionally trusted forwarded headers like `x-forwarded-host`. An attacker could provide a malicious header to make the application use an attacker-controlled URL for verification, thus bypassing the security check.

verifyPlivoWebhook

extensions/voice-call/src/webhook-security.ts

This function, responsible for verifying webhooks from the Plivo provider, was vulnerable because it used the insecure `reconstructWebhookUrl` function without providing any security controls. This allowed an attacker to perform a host header injection attack.

verifyTwilioWebhook

extensions/voice-call/src/webhook-security.ts

This function, which verifies webhooks from Twilio, was vulnerable as it called `buildTwilioVerificationUrl` (which in turn called the insecure `reconstructWebhookUrl`) without passing the necessary security options to validate forwarded headers. This made it possible for an attacker to control the URL used for signature validation.

PlivoProvider.handleWebhook

extensions/voice-call/src/providers/plivo.ts

This is the main webhook handler for the Plivo provider and served as an entry point for the vulnerability. It directly called the vulnerable `verifyPlivoWebhook` function without the new security configurations, thus processing potentially malicious webhook requests.

verifyTwilioProviderWebhook

extensions/voice-call/src/providers/twilio/webhook.ts

This function is called by the `TwilioProvider.handleWebhook` method to verify incoming webhooks. It was vulnerable because it invoked `verifyTwilioWebhook` without passing the required security options to validate forwarded headers, enabling an attacker to bypass signature verification.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

5.9

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-3m3q-x3gj-f79x: OpenClaw optional voice-call plugin: webhook verification may be bypassed behind certain proxy configurations

Affected Packages / Versions

Summary

Impact

Root Cause

Resolution

Fix Commit(s)

Credits

GHSA-3m3q-x3gj-f79x:

5.9

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Basic Information

Basic Information

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

5.9

5.9

Technical Details

GHSA-3m3q-x3gj-f79x: OpenClaw optional voice-call plugin: webhook verification may be bypassed behind certain proxy configurations

Affected Packages / Versions

Summary

Impact

Root Cause

Resolution

Fix Commit(s)

Credits

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI