N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-hhq4-97c2-p447

GHSA-hhq4-97c2-p447: OpenClaw: Zalo webhook replay cache cross-target messageId scope bypass

Summary

Zalo webhook replay cache cross-target messageId scope bypass

Current Maintainer Triage

Status: narrow
Normalized severity: low
Assessment: v2026.3.28 replay dedupe is still keyed too broadly, but the issue should stay scoped to authenticated sibling-target delivery paths rather than arbitrary unauthenticated attackers.

Affected Packages / Versions

Package: openclaw (npm)
Latest published npm version: 2026.3.31
Vulnerable version range: <=2026.3.28
Patched versions: >= 2026.3.31
First stable tag containing the fix: v2026.3.31

Fix Commit(s)

4d038bb242c11f39e45f6a4bde400e5fd42e4ebf — 2026-03-31T19:33:57+09:00

Release Process Note

The fix is already present in released version 2026.3.31.
This draft looks ready for final maintainer disposition or publication, not additional code-fix work.

Thanks @smaeljaish771 for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-hhq4-97c2-p447

GHSA-hhq4-97c2-p447:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	<= 2026.3.28	2026.3.31

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a cross-target message replay issue in the Zalo webhook handler. The root cause was an insufficiently specific cache key used for replay detection in the isReplayEvent function. The key was based only on the event name and message ID, making it possible for a webhook intended for one target to interfere with the processing of a webhook for another target if they shared the same message ID. The patch rectifies this by incorporating the target's path and account ID into the cache key within the isReplayEvent function, thereby scoping the replay detection to each individual target. The handleZaloWebhookRequest function is the entry point that calls this vulnerable logic. Therefore, both handleZaloWebhookRequest and isReplayEvent are the key functions that would appear in a runtime profile when this vulnerability is triggered.

Vulnerable functions

isReplayEvent

extensions/zalo/src/monitor.webhook.ts

The vulnerability is in the `isReplayEvent` function, which was responsible for detecting webhook replay attacks. The original implementation created a cache key for deduplication using only the `event_name` and `message_id` from the webhook payload. This key was not specific to the target receiving the webhook. Consequently, if multiple Zalo targets were configured, a webhook sent to one target could cause a legitimate webhook with the same `message_id` for a different target to be incorrectly flagged as a replay and dropped.

handleZaloWebhookRequest

extensions/zalo/src/monitor.webhook.ts

This function is the primary handler for incoming Zalo webhook requests. It calls the `isReplayEvent` function to perform replay detection. During an exploit, this function would be on the call stack as it processes the malicious or replayed webhook, and it is the function that invokes the vulnerable logic in `isReplayEvent`.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.