OpenClaw's voice‑call plugin versions prior to 2026.2.3 contain an improper authentication flaw in the webhook verification process. The flaw allows remote attackers to bypass verification by supplying forged Forwarded or X‑Forwarded‑* headers, causing the system to accept malicious webhook events. This can lead to unauthorized actions or data exfiltration, representing a case of improper restriction of remote operator control (CWE‑290).

Vendors: OpenClaw’s voice‑call product. All releases earlier than version 2026.2.3 are affected. Users running these versions should verify the exact build against the vendor’s versioning schema.

The vulnerability has a high severity with a CVSS score of 8.2 and an EPSS of less than 1%, indicating a low but nonzero risk of exploitation. It is not listed in the CISA KEV catalog. The likely attack vector is via a reverse‑proxy that forwards untrusted Forwarded headers; after successfully spoofing these headers, an attacker can inject arbitrary webhook events. The probability of exploitation is currently low, yet the potential impact justifies immediate remediation for systems exposed to external traffic or managed cloud proxies that may unintentionally forward these headers.