GHSA-3m3q-x3gj-f79x
Medium · 5.9CVSS
5.9
EPSS
—
Published
Feb 17, 2026
CISA due date
—
The record
OpenClaw optional voice-call plugin: webhook verification may be bypassed behind certain proxy configurations
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @clawdbot/voice-call | 0 | No fix |
| npm | @openclaw/voice-call | 0 | 2026.2.3 |
Related vulnerabilities
- CVE-2026-28465 OpenClaw's voice-call plugin versions before 2026.2.3 contain an improper authentication… Same vulnerability
- CVE-2026-32062 OpenClaw versions 2026.2.21-2 up to, but not including, 2026.2.22, and… Also affects @openclaw/voice-call
- GHSA-mfg5-7q5g-f37j OpenClaw voice-call media stream validated streams after upgrade, which could allow… Also affects @openclaw/voice-call
- CVE-2026-114638 Traefik v3.7.0 before v3.7.14 contains an improper authentication vulnerability in the… CWE-287
- CVE-2026-114639 Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass… CWE-287
- CVE-2026-112104 A flaw has been found in eremef bandcamp-player up to 1.8.33-beta. CWE-287
- CVE-2026-107228 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP… CWE-287
- CVE-2026-86781 The SSL Zen — SSL Certificate Installer & HTTPS Redirects WordPress plugin before 4.7.40… CWE-287