Vulnerability · Published Mar 5, 2026 · Assigned by VulnCheck

CVE-2026-28465OpenClaw voice-call < 2026.2.3 - Webhook Verification Bypass via Forwarded Headers

Medium 5.9

In plain English

A medium-severity authentication bypass by spoofing in voice-call from OpenClaw. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.9Medium

Exploit odds (30 days)0.4%top 62.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

OpenClaw's voice-call plugin versions before 2026.2.3 contain an improper authentication vulnerability in webhook verification that allows remote attackers to bypass verification by supplying untrusted forwarded headers. Attackers can spoof webhook events by manipulating Forwarded or X-Forwarded-* headers in reverse-proxy configurations that implicitly trust these headers.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	@clawdbot/voice-call	no fix listed	GHSA-3m3q-x3gj-f79x
npm	@openclaw/voice-call	2026.2.3	GHSA-3m3q-x3gj-f79x

Affected products (as reported)

Vendor	Product	Versions
OpenClaw	voice-call	0 – before 2026.2.3

Weakness: CWE-290 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

References

GitHub Security Advisory (GHSA-3m3q-x3gj-f79x) vendor-advisory
Patch Commit patch
VulnCheck Advisory: OpenClaw voice-call < 2026.2.3 - Webhook Verification Bypass via Forwarded Headers third-party-advisory