Skip to content
OpenAdvisories

Package · npm

@openclaw/voice-call

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High 7.5
    CVE-2026-32062

    OpenClaw 2026.2.21-2 < 2026.2.22 - Unauthenticated WebSocket Resource Exhaustion via Media Stream

    OpenClaw versions 2026.2.21-2 up to, but not including, 2026.2.22, and @openclaw/voice-call versions 2026.2.21 up to, but not including, 2026.2.22 accept media-stream WebSocket upgrades before stream validation, allowing unauthenticated clients to establish c…

    OpenClaw OpenClaw voice-call openclaw npm
  • Medium 5.9
    CVE-2026-28465

    OpenClaw voice-call < 2026.2.3 - Webhook Verification Bypass via Forwarded Headers

    OpenClaw's voice-call plugin versions before 2026.2.3 contain an improper authentication vulnerability in webhook verification that allows remote attackers to bypass verification by supplying untrusted forwarded headers. Attackers can spoof webhook events by …

    OpenClaw voice-call @openclaw/voice-call @clawdbot/voice-call npm