CVE-2026-41337CWE-367

OpenClaw < 2026.3.31 - Callback Origin Mutation in Plivo Voice-call Replay

Medium · published April 23, 2026

CVSS v4.0
6.3
EPSS
0%
Percentile
23.4
In the wild
Unconfirmed
What it is

OpenClaw before 2026.3.31 contains a callback origin mutation vulnerability in Plivo voice-call replay that allows attackers to mutate in-process callback origin before replay rejection. Attackers with captured valid callbacks for live calls can exploit this to manipulate callback origins during the replay process.

The record
Technical detail
CVSS v4.0
6.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00317 · 23.4th percentile
Weakness
CWE-367 · Time-of-check Time-of-use (TOCTOU) Race Condition
Published
2026-04-23T21:57Z
EPSS history
Timeline
  • 23 APR 21:57Z
    OpenClaw < 2026.3.31 - Callback Origin Mutation in Plivo Voice-call Replay
    cvelistv5