GHSA-cg6c-q2hx-69h7: OpenClaw: Plivo V2 verified replay identity drifts on query-only variants

March 26, 2026 (updated April 9, 2026)

Before v2026.3.23, the Plivo V2 verification path treated query-only variants of the same signed request as fresh verified work. Plivo V2 signatures authenticate baseUrl + nonce, but the replay key was derived from the full verification URL including the query string, so unsigned query-only changes minted a new verifiedRequestKey.

References

github.com/advisories/GHSA-cg6c-q2hx-69h7
github.com/openclaw/openclaw
github.com/openclaw/openclaw/commit/b0ce53a79cf63834660270513e26d921899b4e5b
github.com/openclaw/openclaw/security/advisories/GHSA-cg6c-q2hx-69h7

Code Behaviors & Features

Detect and mitigate GHSA-cg6c-q2hx-69h7 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →