OpenClaw's voice-call plugin versions before 2026.2.3 contain an improper authentication vulnerability in webhook verification that allows remote attackers to b…

OpenClaw's voice-call plugin versions before 2026.2.3 contain an improper authentication vulnerability in webhook verification. Remote attackers can bypass verification by supplying untrusted forwarded headers. The vulnerability allows attackers to spoof webhook events by manipulating Forwarded or X-Forwarded-* headers in reverse-proxy configurations that implicitly trust these headers. This affects webhook verification mechanisms and can lead to unauthorized access.