CVE-2026-32053

OpenClaw < 2026.2.23 - Twilio Webhook Replay Bypass via Randomized Event ID Normalization

State: Published
Severity: 6.9 Medium
Published: Mar 21, 2026
Updated: Jun 23, 2026
Reserved: Mar 10, 2026

Description

OpenClaw versions prior to 2026.2.23 contain a vulnerability in Twilio webhook event deduplication where normalized event IDs are randomized per parse, allowing replay events to bypass manager dedupe checks. Attackers can replay Twilio webhook events to trigger duplicate or stale call-state transitions, potentially causing incorrect call handling and state corruption.

Scores

CVSS	Score	Vector	Source
4.0	6.9 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N	VulnCheck
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L	VulnCheck

Weaknesses

CWE-294 Authentication Bypass by Capture-replay

Affected Products

Product	Versions
OpenClawOpenClaw	before 2026.2.23Affected 2026.2.23Not affected

References

GitHub Security Advisory (GHSA-vqx8-9xxw-f2m7)vendor-advisory
Patch Commitpatch
VulnCheck Advisory: OpenClaw < 2026.2.23 - Twilio Webhook Replay Bypass via Randomized Event ID Normalizationthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.