{"id":"EUVD-2026-9911","revision":"84abeb32f9c94b4da1d0fcf8608eee2d","records":[{"revision":"84abeb32f9c94b4da1d0fcf8608eee2d","observedAt":"2026-11-05T06:02:01.896+00:00","statement":{"source":"euvd","id":"EUVD-2026-9911","aliases":["CVE-2026-28465","GHSA-3m3q-x3gj-f79x"],"title":"OpenClaw's voice-call plugin versions before 2026.2.3 contain an improper authentication vulnerability in webhook verification that allows remote attackers to bypass verification by supplying untrusted forwarded headers. Attackers can spoof…","description":"OpenClaw's voice-call plugin versions before 2026.2.3 contain an improper authentication vulnerability in webhook verification that allows remote attackers to bypass verification by supplying untrusted forwarded headers. Attackers can spoof webhook events by manipulating Forwarded or X-Forwarded-* headers in reverse-proxy configurations that implicitly trust these headers.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","score":8.2,"severity":null}],"references":["https://github.com/openclaw/openclaw/security/advisories/GHSA-3m3q-x3gj-f79x","https://github.com/openclaw/openclaw/commit/a749db9820eb6d6224032a5a34223d286d2dcc2f","https://www.vulncheck.com/advisories/openclaw-voice-call-webhook-verification-bypass-via-forwarded-headers"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-9911","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Mar 5, 2026, 9:59:41 PM","dateUpdated":"Oct 1, 2026, 3:19:53 PM"},"relatedAdvisories":[{"id":"WID-SEC-W-2026-0424","title":"OpenClaw: Mehrere Schwachstellen","vulnerabilityIds":["CVE-2026-28391","CVE-2026-28392","CVE-2026-28393","CVE-2026-28395","CVE-2026-28446","CVE-2026-28447","CVE-2026-28448","CVE-2026-28450","CVE-2026-28451","CVE-2026-28452","CVE-2026-28453","CVE-2026-28454","CVE-2026-28456","CVE-2026-28457","CVE-2026-28458","CVE-2026-28459","CVE-2026-28462","CVE-2026-28463","CVE-2026-28464","CVE-2026-28465","CVE-2026-28466","CVE-2026-28467","CVE-2026-28468","CVE-2026-28469","CVE-2026-28470","CVE-2026-28471","CVE-2026-28472","CVE-2026-28473","CVE-2026-28474","CVE-2026-28475","CVE-2026-28476","CVE-2026-28477","CVE-2026-28478","CVE-2026-28480","CVE-2026-28481","CVE-2026-28482","CVE-2026-28485","CVE-2026-28486","CVE-2026-29606","CVE-2026-29609","CVE-2026-29610","CVE-2026-29611","CVE-2026-29612","CVE-2026-29613"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-9911","identifiers":["EUVD-2026-9911","CVE-2026-28465","GHSA-3m3q-x3gj-f79x"]},"retained":false,"historicalAffected":[]}],"coverage":[]}