Moderate severityNVD Advisory· Published Mar 21, 2026· Updated Mar 23, 2026
OpenClaw < 2026.2.23 - Twilio Webhook Replay Bypass via Randomized Event ID Normalization
CVE-2026-32053
Description
OpenClaw versions prior to 2026.2.23 contain a vulnerability in Twilio webhook event deduplication where normalized event IDs are randomized per parse, allowing replay events to bypass manager dedupe checks. Attackers can replay Twilio webhook events to trigger duplicate or stale call-state transitions, potentially causing incorrect call handling and state corruption.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
openclawnpm | < 2026.2.23 | 2026.2.23 |
Affected products
2Patches
Vulnerability mechanics
References
5- github.com/openclaw/openclaw/commit/1d28da55a5d0ff409e34999e0961157e9db0a2abghsapatchWEB
- github.com/advisories/GHSA-vqx8-9xxw-f2m7ghsaADVISORY
- github.com/openclaw/openclaw/security/advisories/GHSA-vqx8-9xxw-f2m7ghsathird-party-advisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2026-32053ghsaADVISORY
- www.vulncheck.com/advisories/openclaw-twilio-webhook-replay-bypass-via-randomized-event-id-normalizationghsathird-party-advisoryWEB
News mentions
0No linked articles in our index yet.