Replay Identity Vulnerability in OpenClaw Impacting Plivo V2 Signature Verification

CVE-2026-35618

What is CVE-2026-35618?

The OpenClaw software prior to version 2026.3.23 contains a vulnerability in the Plivo V2 signature verification process that allows attackers to exploit replay identity drift. This vulnerability is due to the verification process deriving its replay keys from the entire URL, including the query strings, rather than using the base URL. As a result, attackers can modify query parameters of signed requests and create new verified request keys without proper authorization. This flaw undermines the replay protection mechanism intended to secure communications, thereby posing a significant risk to application integrity.

References