EUVD-2026-45359
GHSA-mhxf-xvw6-4qw2
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable webhook, no privileges required; integrity-only impact limited to replay-injected bot actions, no confidentiality or availability effect.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security flaw has been discovered in Sipeed PicoClaw up to 0.2.9. This affects the function webhook.ParseRequest of the file pkg/channels/line/line.go of the component LINE Webhook. The manipulation results in authentication bypass by capture-replay. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The reported GitHub issue was closed automatically with the label "not planned" by a bot.
AnalysisAI
Authentication bypass via capture-replay in Sipeed PicoClaw's LINE Webhook handler permits remote unauthenticated attackers to replay previously captured webhook requests against the ParseRequest function, injecting fraudulent LINE messaging events without possessing the channel secret. All versions through 0.2.9 are affected. A public exploit exists, and the vendor closed the GitHub disclosure as 'not planned,' confirming no official patch will be issued.
Technical ContextAI
PicoClaw is an open-source Sipeed messaging bot framework that integrates with the LINE messaging platform via webhooks. The vulnerable function is webhook.ParseRequest in pkg/channels/line/line.go. CWE-294 (Authentication Bypass by Capture-Replay) indicates the function fails to enforce replay prevention - likely missing or bypassable validation of request freshness (timestamp checks) or uniqueness (nonce tracking) alongside the LINE HMAC-SHA256 signature. LINE's official webhook spec requires validating the X-Line-Signature header; the flaw suggests that even when signature validation passes, previously observed valid requests can be replayed indefinitely. CPE cpe:2.3:a:sipeed:picoclaw:*:*:*:*:*:* covers all versions with no lower bound, implying the entire release history is affected.
RemediationAI
No vendor-released patch has been identified at time of analysis - the vendor explicitly declined to address the issue by closing the GitHub report as 'not planned.' Operators running PicoClaw with LINE Webhook integration should implement replay protection manually by forking the codebase and patching webhook.ParseRequest in pkg/channels/line/line.go to enforce timestamp freshness validation (e.g., reject requests with timestamps older than 5 minutes) and nonce deduplication. As an immediate compensating control, restrict the webhook endpoint to LINE's published source IP ranges using firewall rules or reverse proxy allowlisting, reducing the attacker's ability to deliver replayed requests. Migrating to an actively maintained messaging bot framework is recommended as a long-term resolution given the vendor's stated non-intent to patch. VulDB intelligence is available at https://vuldb.com/vuln/379795.
Server-side request forgery in Sipeed PicoClaw up to version 0.2.9 allows unauthenticated remote attackers to make the s
Improper access control in Sipeed PicoClaw up to version 0.2.9 allows remote unauthenticated attackers to bypass the IP
Server-side request forgery in Sipeed PicoClaw through version 0.2.9 allows low-privileged remote attackers to cause the
Missing authorization in PicoClaw's Feishu group message handler allows authenticated remote attackers to perform unauth
Incorrect authorization in Sipeed PicoClaw's WeCom Group Message Handler allows authenticated remote attackers to bypass
Server-side request forgery in Sipeed PicoClaw up to version 0.2.9 allows remote attackers to manipulate the WebFetchToo
Missing authorization in Sipeed PicoClaw up to version 0.2.9 permits remote low-privileged attackers to invoke the rt.Re
Incorrect authorization in Sipeed PicoClaw's MQTT Channel Handler (pkg/channels/mqtt/mqtt.go) through version 0.2.9 allo
Cross-site request forgery in Sipeed PicoClaw through version 0.2.9 allows a remote attacker to forge the initial admin
Inclusion of functionality from an untrusted control sphere (CWE-829) in Sipeed PicoClaw through version 0.2.9 allows a
Time-of-check time-of-use race condition in Sipeed PicoClaw up to version 0.2.9 allows locally authenticated low-privile
Remote command injection in PicoClaw Web Launcher Management Plane (versions up to 0.2.4) allows unauthenticated attacke
Same weakness CWE-294 – Authentication Bypass by Capture-replay
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today