GHSA-vqx8-9xxw-f2m7: OpenClaw's voice-call Twilio webhook replay could bypass manager dedupe because normalized event IDs were randomized per parse

March 3, 2026

Twilio webhook replay events could bypass voice-call manager dedupe because normalized event IDs were randomized per parse. A replayed event could be treated as new and trigger duplicate or stale call-state transitions.

References

github.com/advisories/GHSA-vqx8-9xxw-f2m7
github.com/openclaw/openclaw
github.com/openclaw/openclaw/commit/1d28da55a5d0ff409e34999e0961157e9db0a2ab
github.com/openclaw/openclaw/security/advisories/GHSA-vqx8-9xxw-f2m7

Code Behaviors & Features

Detect and mitigate GHSA-vqx8-9xxw-f2m7 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →