CVE-2026-28465
Medium · 5.9CVSS
5.9
EPSS
0.7%
Published
Mar 5, 2026
CISA due date
—
The record
OpenClaw's voice-call plugin versions before 2026.2.3 contain an improper authentication vulnerability in webhook verification that allows remote attackers to bypass verification by supplying untrusted forwarded headers. Attackers can spoof webhook events by manipulating Forwarded or X-Forwarded-* headers in reverse-proxy configurations that implicitly trust these headers.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @clawdbot/voice-call | 0 | No fix |
| npm | @openclaw/voice-call | 0 | 2026.2.3 |
Related vulnerabilities
- GHSA-3m3q-x3gj-f79x OpenClaw optional voice-call plugin: webhook verification may be bypassed behind certain… Same vulnerability
- CVE-2026-32062 OpenClaw versions 2026.2.21-2 up to, but not including, 2026.2.22, and… Also affects @openclaw/voice-call
- GHSA-mfg5-7q5g-f37j OpenClaw voice-call media stream validated streams after upgrade, which could allow… Also affects @openclaw/voice-call
- CVE-2026-114640 Traefik from v3.7.0 before v3.7.14 contains an authentication bypass vulnerability in its… CWE-290
- CVE-2026-90711 proxy-addr is a Node.js module that determines a request's client address behind trusted… CWE-290
- CVE-2026-66674 Unauthenticated Bypass Vulnerability in Simple Cloudflare Turnstile <= 1.42.1 versions. CWE-290
- CVE-2026-82563 An attacker could impersonate the camera and place themselves in a man-in-the-middle or… CWE-290
- CVE-2026-82530 IP2Location Country Blocker plugin for WordPress before 2.45.0 contains an access control… CWE-290