GHSA-c37p-4qqg-3p76: OpenClaw Twilio voice-call webhook auth bypass when ngrok loopback compatibility is enabled

February 18, 2026

A Twilio webhook signature-verification bypass in the voice-call extension could allow unauthenticated webhook requests when a specific ngrok free-tier compatibility option is enabled.

References

github.com/advisories/GHSA-c37p-4qqg-3p76
github.com/openclaw/openclaw
github.com/openclaw/openclaw/commit/ff11d8793b90c52f8d84dae3fbb99307da51b5c9
github.com/openclaw/openclaw/releases/tag/v2026.2.14
github.com/openclaw/openclaw/security/advisories/GHSA-c37p-4qqg-3p76

Code Behaviors & Features

Detect and mitigate GHSA-c37p-4qqg-3p76 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →