What is the CVSS score of CVE-2026-32053?

CVE-2026-32053 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Openclaw are affected by CVE-2026-32053?

CVE-2026-32053 presents notable security risk rated CVSS 6.5. Exploitation could compromise the security of affected deployments. Proof-of-concept code is publicly available.. A patch is available.

Is there a public PoC exploit available for CVE-2026-32053?

Yes, a public proof-of-concept exploit is available for CVE-2026-32053. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-32053?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Vendor patch is available.

Openclaw CVE-2026-32053

EUVD-2026-13954 MEDIUM

Authentication Bypass by Capture-replay (CWE-294)

2026-03-21 VulnCheck

GHSA-3r78-rqg8-95gg

Authentication Bypass Openclaw

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

PoC Detected

Mar 24, 2026 - 21:15 vuln.today

Public exploit code

EUVD ID Assigned

Mar 21, 2026 - 01:00 euvd

EUVD-2026-13954

Analysis Generated

Mar 21, 2026 - 01:00 vuln.today

Patch released

Mar 21, 2026 - 01:00 nvd

Patch available

CVE Published

Mar 21, 2026 - 00:42 nvd

MEDIUM 6.5

DescriptionCVE.org

OpenClaw versions prior to 2026.2.23 contain a vulnerability in Twilio webhook event deduplication where normalized event IDs are randomized per parse, allowing replay events to bypass manager dedupe checks. Attackers can replay Twilio webhook events to trigger duplicate or stale call-state transitions, potentially causing incorrect call handling and state corruption.

AnalysisAI

OpenClaw versions prior to 2026.2.23 contain a webhook event deduplication bypass vulnerability where normalized Twilio event IDs are randomized on each parse, allowing attackers to replay webhook events and circumvent the manager's deduplication checks. An unauthenticated remote attacker can exploit this over the network to trigger duplicate or stale call-state transitions, potentially causing incorrect call handling and state corruption. While no CVSS modifier for active exploitation or public POC is explicitly confirmed in the provided intelligence, the CVSS 6.5 score reflects moderate integrity and availability impact with low attack complexity.

Technical ContextAI

The vulnerability exists in OpenClaw's Twilio webhook event handling mechanism, specifically in the event deduplication logic (CWE-294: Improper Verification of Cryptographic Signature). Twilio sends webhook notifications for call events; OpenClaw should deduplicate these by storing and comparing normalized event IDs. However, the normalization process generates randomized IDs on each parse rather than producing consistent, deterministic identifiers. This violates the fundamental principle that idempotent deduplication requires stable, deterministic identifiers. The affected product is OpenClaw (CPE: cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*), with versions prior to 2026.2.23 impacted. The root cause is improper cryptographic or hash-based signature verification in the webhook validation chain, allowing replayed events to bypass integrity checks.

RemediationAI

Upgrade OpenClaw to version 2026.2.23 or later immediately; this is the primary fix as a patch is available from the vendor. Apply the commit 1d28da55a5d0ff409e34999e0961157e9db0a2ab or pull the latest stable release from the GitHub repository (https://github.com/openclaw/openclaw). As an interim mitigation pending deployment, implement network-level access controls to restrict Twilio webhook sources to documented Twilio IP ranges, enable webhook event logging and monitoring to detect replay patterns (e.g., duplicate event IDs arriving in quick succession), and consider implementing an additional application-level deduplication layer that persists event IDs in a distributed cache (Redis, DynamoDB) to ensure stable, non-randomized identifiers survive process restarts. Verify the patch by confirming that event ID normalization produces deterministic output and test Twilio webhook replay scenarios in a staging environment before production rollout.