CVEReports
CVEReports

Automated vulnerability intelligence platform. Comprehensive reports for high-severity CVEs generated by AI.

Product

  • Home
  • Sitemap
  • RSS Feed

Company

  • About
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 CVEReports. All rights reserved.

Made with love by Amit Schendel & Alon Barad



GHSA-R9Q5-C7QC-P26W

GHSA-R9Q5-C7QC-P26W: Webhook Replay Vulnerability in OpenClaw Nextcloud Talk Integration

Alon Barad
Alon Barad
Software Engineer

Mar 4, 2026·4 min read·15 visits

Executive Summary (TL;DR)

OpenClaw's Nextcloud Talk webhook handler accepts replayed requests due to missing nonce/ID verification. Attackers can trigger duplicate AI actions. Fixed in v2026.2.25.

A capture-replay vulnerability exists in the Nextcloud Talk integration of the OpenClaw AI platform. The webhook handler properly verifies cryptographic signatures but fails to track processed message identifiers, allowing attackers to re-submit captured valid requests. This results in duplicate processing of AI commands and potential redundant side effects.

Vulnerability Overview

OpenClaw acts as a personal AI assistant that integrates with various platforms, including Nextcloud Talk, to receive and process user messages. The integration relies on incoming webhooks to trigger AI responses and execute tool-based commands. A vulnerability was identified in how these webhooks are processed: the system is stateless regarding message history.

While the application implements cryptographic signature verification using x-nextcloud-talk-signature (HMAC), it does not maintain a record of processed request identifiers (nonces or message IDs). This omission allows valid, signed requests to be captured and replayed against the server. The server accepts these replayed requests as new, legitimate events because the signature remains mathematically valid for the payload.

Root Cause Analysis

The root cause is a Missing Replay Protection mechanism (CWE-294) within the webhook handler. Secure webhook implementations typically require two components: identity verification (signature) and uniqueness verification (nonce/timestamp caching). OpenClaw implemented the former but neglected the latter.

Specifically, the onMessage handler in the Nextcloud Talk extension accepts HTTP POST requests and verifies headers. However, prior to version 2026.2.25, the handler lacked a deduplication logic or a state store to track the messageId or token of processed requests. Consequently, if an attacker intercepts a request with a valid x-nextcloud-talk-signature, they can resend it indefinitely. The application logic re-processes the payload, triggering the AI agent's logic flow anew for every submission.

Code Analysis & Fix

The remediation introduced in version 2026.2.25 adds a persistence layer to track processed messages. A new component, NextcloudTalkReplayGuard, was implemented to check incoming message IDs against a local JSON-based deduplication store.

The fix involves two key changes:

  1. Persistent Deduplication: The system now extracts a unique identifier from the webhook payload and checks if it exists in a replay-dedupe log on disk. If the ID is found and the entry is within the Time-To-Live (TTL) window, the request is rejected.
  2. Origin Validation: The patch adds a check against the x-nextcloud-talk-backend header to ensure the request originates from the configured Nextcloud instance URL, preventing cross-tenant replays.

Fixed Logic (Simplified):

// src/replay-guard.ts
export function createNextcloudTalkReplayGuard(options) {
  const persistentDedupe = createPersistentDedupe({
    ttlMs: options.ttlMs ?? DEFAULT_REPLAY_TTL_MS,
    // Stores IDs in: state/nextcloud-talk/replay-dedupe/<namespace>.json
    resolveFilePath: (namespace) => path.join(stateDir, ...),
  });
 
  return {
    shouldProcessMessage: async ({ accountId, roomToken, messageId }) => {
      // Unique key combines token and message ID
      const replayKey = `${roomToken}:${messageId}`;
      // Returns false if key already exists
      return await persistentDedupe.checkAndRecord(replayKey, { namespace: accountId });
    },
  };
}

Exploitation Scenario

Exploitation requires an attacker to have network visibility to capture traffic between the Nextcloud instance and the OpenClaw server (e.g., via Man-in-the-Middle or access to a proxy log). No authentication credentials are required to replay the request, as the valid signature is contained within the captured headers.

Attack Steps:

  1. Interception: The attacker passively monitors traffic to the OpenClaw webhook endpoint.
  2. Capture: The attacker records a valid HTTP POST request, preserving the body and the headers x-nextcloud-talk-signature, x-nextcloud-talk-random, and x-nextcloud-talk-backend.
  3. Replay: The attacker uses a tool like curl or Burp Suite to resend the exact request to the OpenClaw server.
  4. Result: The server validates the signature (which is still valid for that specific body) and processes the message again. The AI agent generates a duplicate response or executes the associated command a second time.

Impact Assessment

The primary impact is integrity violation regarding application state and resource exhaustion.

  • Duplicate Actions: If the replayed message contains a command (e.g., "Schedule a meeting at 2 PM"), the AI agent may attempt to execute this action multiple times. Depending on the downstream system's idempotency, this could create duplicate calendar entries, tasks, or database records.
  • API Cost Inflation: AI processing typically involves calls to paid LLM APIs (e.g., OpenAI, Anthropic). An attacker could flood the system with replayed requests to exhaust the victim's API credits.
  • Operational Noise: Duplicate processing pollutes logs and chat history, potentially confusing users and complicating audit trails.

Official Patches

OpenClawCommit d512163d: Add replay guard

Fix Analysis (1)

Technical Appendix

CVSS Score
Unknown/ 10

Affected Systems

OpenClaw Nextcloud Talk Integration

Affected Versions Detail

Product
Affected Versions
Fixed Version
OpenClaw
OpenClaw
< 2026.2.252026.2.25
AttributeDetail
CWECWE-294
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
ImpactDuplicate Processing

MITRE ATT&CK Mapping

T1557Adversary-in-the-Middle
Credential Access
T1499Endpoint Denial of Service
Impact
CWE-294
Authentication Bypass by Capture-replay

A capture-replay flaw occurs when a design does not properly validate that a request is unique or fresh, allowing an attacker to resubmit a captured valid request.

Vulnerability Timeline

Vulnerability reported by @aristorechina
2026-02-25
Fix commit pushed by Peter Steinberger
2026-02-25
OpenClaw v2026.2.25 released with fix
2026-02-26

References & Sources

  • [1]GitHub Advisory GHSA-R9Q5-C7QC-P26W
  • [2]Security Blog Post: OpenClaw Message Reliability

Attack Flow Diagram

Press enter or space to select a node. You can then use the arrow keys to move the node around. Press delete to remove it and escape to cancel.
Press enter or space to select an edge. You can then press delete to remove it or escape to cancel.

More Reports

•about 14 hours ago•GHSA-X445-F3H2-J279
7.5

GHSA-X445-F3H2-J279: OAuth Provider Confusion in Auth.js and NextAuth.js

A critical logical security flaw exists in Auth.js (formerly NextAuth.js) where signed anti-CSRF check cookies (state, nonce, and PKCE code_verifier) are not bound to the specific Identity Provider that initiated the authorization flow. In multi-provider environments, this allows an attacker to replay valid, cryptographically signed cookies minted during a flow with one provider against a callback handling a different provider. This vulnerability can lead to session hijacking, identity theft, or unauthorized account linking.

Alon Barad
Alon Barad
7 views•7 min read
•about 15 hours ago•GHSA-7RQJ-J65F-68WH
8.1

GHSA-7RQJ-J65F-68WH: Account Takeover via Homoglyph Bypass in NextAuth.js Email Normalization

A security vulnerability in the email normalization logic of NextAuth.js and Auth.js allows remote attackers to bypass email validation constraints and achieve Account Takeover (ATO) through Unicode homoglyph smuggling. Under standard conditions, Unicode compatibility characters represent visually similar symbols that are normalized downstream to ASCII equivalents, facilitating structural validation bypasses. This issue specifically affects passwordless email authentication flows.

Alon Barad
Alon Barad
8 views•6 min read
•about 16 hours ago•GHSA-XMF8-CVQR-RFGJ
7.5

GHSA-XMF8-CVQR-RFGJ: Denial of Service via Uncaught Exception and Session Confusion in Auth.js

Auth.js (formerly NextAuth.js) contains a denial of service vulnerability due to an uncaught URIError in the getToken() token parser when processing malformed percent-encoded sequences in bearer tokens. Additionally, the library was vulnerable to session state confusion and replay attacks because OAuth check cookies (state, nonce, and PKCE) were not properly bound to specific providers, permitting cross-provider token reuse.

Amit Schendel
Amit Schendel
6 views•6 min read
•about 17 hours ago•CVE-2026-53467
5.3

CVE-2026-53467: Heap Information Disclosure via Uninitialized Pixel Cache in ImageMagick MNG Decoder

CVE-2026-53467 is a heap information disclosure vulnerability in the Multiple-image Network Graphics (MNG) decoder of ImageMagick. The vulnerability arises from a failure to zero-initialize newly allocated pixel cache memory buffers. A remote attacker can exploit this by submitting a crafted sparse MNG image file to trigger uninitialized memory preservation. The resulting output contains residual heap bytes, potentially leaking sensitive process memory or assisting in ASLR bypass.

Amit Schendel
Amit Schendel
7 views•6 min read
•about 18 hours ago•CVE-2026-55223
6.3

CVE-2026-55223: Remote Code Execution via Deserialization Gadget Chain in c3p0 Connection Pooling Library

An untrusted deserialization vulnerability exists in the c3p0 JDBC connection pooling library before version 0.14.0. Standard JDBC getter methods conform to the JavaBean property getter pattern, allowing introspection libraries like Apache Commons BeanUtils to evaluate connection properties dynamically during deserialization, leading to arbitrary code execution when chained with a vulnerable database driver or JNDI sink.

Alon Barad
Alon Barad
6 views•6 min read
•about 19 hours ago•CVE-2026-54696
3.7

CVE-2026-54696: Heap-based Buffer Overflow in Ruby json Gem Native C Extension

A heap-based buffer overflow vulnerability exists in the native C extension of the Ruby json gem (versions 2.9.0 through 2.19.8) during IO-based streaming serialization. An incorrect buffer size calculation can lead to memory corruption and process termination when processing large strings.

Alon Barad
Alon Barad
8 views•6 min read