CVE-2026-35618

Katalog CVE

CVSS 6.5 · Medium EPSS 0,37%

Kerentanan Authentication Bypass by Capture-replay pada openclaw. Skor CVSS 3.1 6.5 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

OpenClaw before 2026.3.23 contains a replay identity vulnerability in Plivo V2 signature verification that allows attackers to bypass replay protection by modifying query parameters. The verification path derives replay keys from the full URL including query strings instead of the canonicalized base URL, enabling attackers to mint new verified request keys through unsigned query-only changes to signed requests.

Rincian

Terbit di NVD

9 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-294: Authentication Bypass by Capture-replay

EPSS (30 hari)

0,37% peluang dieksploitasi; lebih tinggi dari 29,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openclaw/openclaw/security/advisories/GHSA-cg6c-q2hx-69h7 advisory vendor
• https://github.com/openclaw/openclaw/commit/630f1479c44f78484dfa21bb407cbe6f171dac87 patch
• https://github.com/openclaw/openclaw/commit/b0ce53a79cf63834660270513e26d921899b4e5b patch
• https://www.vulncheck.com/advisories/openclaw-replay-identity-drift-via-query-only-variants-in-plivo-v2-verifi... advisory pihak ketiga