CVE-2026-35618

OpenClaw < 2026.3.23 - Replay Identity Drift via Query-Only Variants in Plivo V2 Verification

State: Published
Severity: 8.3 High
Published: Apr 9, 2026
Updated: Jun 23, 2026
Reserved: Apr 4, 2026

Description

OpenClaw before 2026.3.23 contains a replay identity vulnerability in Plivo V2 signature verification that allows attackers to bypass replay protection by modifying query parameters. The verification path derives replay keys from the full URL including query strings instead of the canonicalized base URL, enabling attackers to mint new verified request keys through unsigned query-only changes to signed requests.

Scores

CVSS	Score	Vector	Source
4.0	8.3 High	CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N	VulnCheck
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N	VulnCheck

Weaknesses

CWE-294 Authentication Bypass by Capture-replay

Affected Products

Product	Versions
OpenClawOpenClaw	before 2026.3.23Affected 2026.3.23Not affected

References

GitHub Security Advisory (GHSA-cg6c-q2hx-69h7)vendor-advisory
Patch Commit #1patch
Patch Commit #2patch
VulnCheck Advisory: OpenClaw < 2026.3.23 - Replay Identity Drift via Query-Only Variants in Plivo V2 Verificationthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.