CVE-2026-41351: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-41351 is a replay detection bypass vulnerability in OpenClaw's webhook signature handling, specifically affecting Telnyx webhook processing. The flaw causes the application to treat Base64 and Base64URL encoded signatures as distinct requests, allowing attackers to re-encode a captured webhook signature and replay it while still passing signature verification. It affects the OpenClaw npm package versions ≤ 2026.3.28, with the fix introduced in version 2026.3.31. The vulnerability was published on April 23, 2026, and carries a CVSS v3.1 score of 5.3 (Medium) and a CVSS v4.0 score of 6.3 (Medium) (GitHub Advisory, Feedly).

The root cause is classified as CWE-294 (Authentication Bypass by Capture-replay). In the vulnerable code path within extensions/voice-call/src/webhook-security.ts, the verifyTelnyxWebhook function computed the replay detection cache key (replayKey) using the raw signature string as received in the telnyx-signature-ed25519 header. Because Base64 and Base64URL are encoding variants of the same binary value (differing only in use of +/-, //_, and optional = padding), the same cryptographic signature could be presented in two forms that both pass Ed25519 verification but produce different SHA-256 replay keys, effectively bypassing the replay cache. The fix canonicalizes the decoded signature buffer back to standard Base64 before computing the replay key, ensuring both encoding variants map to the same cache entry (GitHub Commit, GitHub Advisory).

Successful exploitation allows a network attacker to replay previously captured Telnyx webhook requests without authorization, bypassing the replay detection mechanism while still satisfying signature verification. This can lead to unauthorized repetition of webhook-triggered actions — such as call control events — potentially causing unintended state changes or data manipulation in applications that process these webhooks. The confidentiality impact is rated low (limited information exposure), with no direct integrity or availability impact assessed by the CVSS scoring (Feedly, GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability requires the attacker to first capture a legitimate Telnyx webhook request (attack requirement: Present, per CVSS v4.0), but no privileges or user interaction are needed beyond that. The EPSS score is approximately 0.028% (0.000280), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

1. Capture a legitimate webhook request: Intercept or observe a valid Telnyx webhook HTTP request sent to a target OpenClaw-powered endpoint, capturing the telnyx-signature-ed25519 header value (a Base64-encoded Ed25519 signature), the telnyx-timestamp header, and the raw request body.
2. Re-encode the signature: Convert the captured Base64 signature to its Base64URL equivalent by replacing + with -, / with _, and stripping trailing = padding characters (e.g., using a simple script or command-line tool).
3. Replay the request: Send an HTTP POST request to the same webhook endpoint with the original telnyx-timestamp and raw body, but substituting the re-encoded Base64URL signature in the telnyx-signature-ed25519 header.
4. Bypass replay detection: Because the vulnerable code hashes the raw signature string for the replay cache key, the re-encoded signature produces a different cache key than the original, causing the server to treat it as a new, unseen request — while Ed25519 signature verification still succeeds since the underlying binary value is identical.
5. Trigger repeated webhook actions: The replayed request is processed as a valid, non-duplicate webhook event, potentially triggering call control actions or other webhook-driven business logic a second (or subsequent) time (GitHub Commit, GitHub Advisory).

• Network: Repeated HTTP POST requests to the Telnyx webhook endpoint with identical request bodies and timestamps but differing telnyx-signature-ed25519 header values (one in standard Base64, one in Base64URL encoding).
• Logs: Webhook processing logs showing multiple successful verifications for requests with the same telnyx-timestamp and body payload but different signature strings; absence of replay detection rejections for what should be duplicate events.
• Application Behavior: Duplicate execution of webhook-triggered actions (e.g., call control events firing more than once for the same call ID) within a short time window, suggesting replayed events are being processed.

Upgrade the OpenClaw npm package to version 2026.3.31 or later, which canonicalizes Base64/Base64URL signatures to a standard form before computing the replay detection cache key (GitHub Commit). As an additional defense-in-depth measure, implement supplementary replay detection based on timestamp validation windows and unique request/nonce ID tracking independent of the signature string. Monitor webhook processing logs for patterns of repeated requests with identical payloads but variant signature encodings (GitHub Advisory).

The vulnerability was reported by security researcher AntAISecurityLab and acknowledged by the OpenClaw maintainers, who assessed the normalized severity as low given that signature verification itself remains valid — only the replay detection is bypassed (GitHub Advisory). A duplicate GitHub Advisory (GHSA-m958-864j-xq5w) was published and subsequently withdrawn on May 4, 2026, in favor of the canonical advisory GHSA-37v6-fxx8-xjmx. No significant broader media coverage or social media discussion has been identified.