cve.bz

CVE-2026-28465

8.2 highEPSS 0.4%

High (8.2) in openclaw openclaw. EPSS 0.4% chance of exploitation in the next 30 days. Fixed in @openclaw/voice-call 2026.2.3.

OpenClaw's voice-call plugin versions before 2026.2.3 contain an improper authentication vulnerability in webhook verification that allows remote attackers to bypass verification by supplying untrusted forwarded headers. Attackers can spoof webhook events by manipulating Forwarded or X-Forwarded-* headers in reverse-proxy configurations that implicitly trust these headers.

Severity

CVSS 4.0

8.2 high
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

7.5 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS
0.4% chance of exploitation in the next 30 days; higher than 37% of CVEs (scores of 2026-10-31)
CWE
CWE-290
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-3m3q-x3gj-f79xnpm@openclaw/voice-call<2026.2.32026.2.3
GHSA-3m3q-x3gj-f79xnpm@clawdbot/voice-call<=2026.1.24no fix published

References

Check your stackJSON