CVE-2026-32053

OpenClaw < 2026.2.23 - Twilio Webhook Replay Bypass via Randomized Event ID Normalization

Published Mar 21, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Description

OpenClaw versions prior to 2026.2.23 contain a vulnerability in Twilio webhook event deduplication where normalized event IDs are randomized per parse, allowing replay events to bypass manager dedupe checks. Attackers can replay Twilio webhook events to trigger duplicate or stale call-state transitions, potentially causing incorrect call handling and state corruption.

Analysis

Technical impact

The vulnerability is in the Twilio webhook event deduplication logic of OpenClaw. Normalized event IDs are randomized for each parse, allowing attackers to replay webhook events that normally would be blocked by a deduplication manager. This can lead to duplicate or stale call-state transitions, potentially causing incorrect call handling and state corruption.

Affected Systems

OpenClaw OpenClaw versions earlier than 2026.2.23, which run on a Node.js environment as indicated by the CPE string. Systems using any of these versions are affected and must be identified.

Risk and Exploitability

The CVSS score of 6.9 indicates a medium severity vulnerability. No EPSS score is provided and it is not listed in the CISA KEV catalog, implying no confirmed widespread exploitation at this time. Attackers likely need remote network access to the Twilio webhook endpoint and can send repeated events to trigger the deduplication bypass, making the exploitation straightforward for anyone with legitimate Twilio integration credentials.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

OpenClaw

unaffected

Version	Status	Constraints
`0`	affected	< 2026.2.23
`2026.2.23`	unaffected	—

Configuration 1 [-]

cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*

No data.

Vendor Product Versions

Openclaw

Version	Status	Scheme	Platform
`[0,2026.2.23)`	affected	semver	—
`2026.2.23`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade OpenClaw to version 2026.2.23 or later.
Verify the Twilio webhook endpoint configuration after the upgrade to ensure event deduplication is functioning correctly.
If immediate upgrade is not feasible, implement application‑level duplicate event detection or rate limiting on the webhook handler to reduce the impact of replayed events.

Generated by OpenCVE AI on March 21, 2026 at 06:56 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-vqx8-9xxw-f2m7	OpenClaw's voice-call Twilio webhook replay could bypass manager dedupe because normalized event IDs were randomized per parse

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.358% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/openclaw/openclaw/commit/1d28da55a5d0ff409e34999e0961157e9db0a2ab
https://github.com/openclaw/openclaw/security/advisories/GHSA-vqx8-9xxw-f2m7
https://www.vulncheck.com/advisories/openclaw-twilio-webhook-replay-bypass-via-randomized-event-id-normalization

History

Mar 23, 2026 6:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mar 21, 2026 5:30 AM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		OpenClaw versions prior to 2026.2.23 contain a vulnerability in Twilio webhook event deduplication where normalized event IDs are randomized per parse, allowing replay events to bypass manager dedupe checks. Attackers can replay Twilio webhook events to trigger duplicate or stale call-state transitions, potentially causing incorrect call handling and state corruption.
Title		OpenClaw < 2026.2.23 - Twilio Webhook Replay Bypass via Randomized Event ID Normalization
First Time appeared		Openclaw Openclaw openclaw
Weaknesses		CWE-294
CPEs		cpe:2.3:a:openclaw:openclaw::::::node.js::*
Vendors & Products		Openclaw Openclaw openclaw
References		https://github.com/openclaw/openclaw/commit/1d28da55a5d0ff409e34999e0961157e9db0a2ab https://github.com/openclaw/openclaw/security/advisories/GHSA-vqx8-9xxw-f2m7 https://www.vulncheck.com/advisories/openclaw-twilio-webhook-replay-bypass-via-randomized-event-id-normalization
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L'}` cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N'}`