CVE-2026-35618
Received Received - Intake
Replay Identity Bypass in OpenClaw Plivo V2 Signature Verification

Publication date: 2026-04-09

Last updated on: 2026-04-17

Assigner: VulnCheck

Description
OpenClaw before 2026.3.23 contains a replay identity vulnerability in Plivo V2 signature verification that allows attackers to bypass replay protection by modifying query parameters. The verification path derives replay keys from the full URL including query strings instead of the canonicalized base URL, enabling attackers to mint new verified request keys through unsigned query-only changes to signed requests.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-09
Last Modified
2026-04-17
Generated
2026-06-16
AI Q&A
2026-04-10
EPSS Evaluated
2026-06-15
NVD
CVE-2026-35618
EUVD
EUVD-2026-21103
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
openclaw openclaw to 2026.3.23 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-294 A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in OpenClaw versions before 2026.3.23 and involves the Plivo V2 signature verification process. Attackers can bypass replay protection by modifying query parameters in the URL. The issue arises because the verification process derives replay keys from the full URL including query strings, rather than from a canonicalized base URL. This allows attackers to create new verified request keys by making unsigned changes only to the query parameters of signed requests.

Impact Analysis

This vulnerability can allow attackers to bypass replay protection mechanisms, potentially enabling them to resend or replay previously valid requests with modified query parameters. This could lead to unauthorized actions or data manipulation, as the system may accept these replayed requests as legitimate due to the flawed verification process.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-35618. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart