A logic flaw in OpenClaw’s handling of Zalo webhook replay deduplication keys allows legitimate events from distinct conversations or senders to collide. The collision suppresses messages silently, thereby disrupting bot workflows that rely on timely message delivery. The weakness is a CWE‑706 type authority and control flaw where the system fails to enforce adequate scope isolation for event deduplication.

The affected product is OpenClaw, documented as OpenClaw:OpenClaw. Versions prior to 2026.4.2 are insecure; no other specific revisions are listed.

The CVSS score of 6.3 indicates moderate severity, while the EPSS score of less than 1% suggests low current exploitation probability. The vulnerability is not listed in CISA KEV. Exploitation requires an attacker to send crafted Zalo webhook events that share the deduplication key used by OpenClaw. Because the system does not enforce per‑conversation scoping, messages from different sources can be treated as duplicates, leading to silent loss of traffic. The likely attack vector is through unauthorized or manipulated webhook traffic, often feasible for an adversary who can intercept or inject requests in the communication channel.