Replay Identity Bypass in OpenClaw Plivo V2 Signature Verification

Publication date: 2026-04-09

Last updated on: 2026-04-17

Assigner: VulnCheck

Description

OpenClaw before 2026.3.23 contains a replay identity vulnerability in Plivo V2 signature verification that allows attackers to bypass replay protection by modifying query parameters. The verification path derives replay keys from the full URL including query strings instead of the canonicalized base URL, enabling attackers to mint new verified request keys through unsigned query-only changes to signed requests.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-09

Last Modified

2026-04-17

Generated

2026-07-06

AI Q&A

2026-04-10

EPSS Evaluated

2026-07-05

NVD

CVE-2026-35618

EUVD

EUVD-2026-21103

Affected Vendors & Products

Vendor	Product	Version / Range
openclaw	openclaw	to 2026.3.23 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-294	A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).

Attack-Flow Graph

Executive Summary

This vulnerability exists in OpenClaw versions before 2026.3.23 and involves the Plivo V2 signature verification process. Attackers can bypass replay protection by modifying query parameters in the URL. The issue arises because the verification process derives replay keys from the full URL including query strings, rather than from a canonicalized base URL. This allows attackers to create new verified request keys by making unsigned changes only to the query parameters of signed requests.

Impact Analysis

This vulnerability can allow attackers to bypass replay protection mechanisms, potentially enabling them to resend or replay previously valid requests with modified query parameters. This could lead to unauthorized actions or data manipulation, as the system may accept these replayed requests as legitimate due to the flawed verification process.

Hi! I’m here to help you understand CVE-2026-35618. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70