CVE-2026-16083 is an authentication bypass vulnerability in Sipeed PicoClaw up to version 0.2.9. It affects the webhook.ParseRequest function in the pkg/channels/line/line.go file of the LINE Webhook component. The vulnerability allows an attacker to bypass authentication by replaying captured requests. The attack can be performed remotely. The exploit has been publicly disclosed, but the vendor has closed the related GitHub issue with a 'not planned' label, indicating no official fix is forthcoming.

Successful exploitation of this vulnerability allows an attacker to bypass authentication mechanisms in the affected versions of Sipeed PicoClaw, potentially enabling unauthorized access or actions via the LINE Webhook interface. This could lead to unauthorized control or data manipulation within the affected system. The vulnerability is remotely exploitable and the exploit code is publicly available, increasing the risk of attacks.

No official fix or patch is currently available for this vulnerability, as the vendor has indicated no plans to address it. Users should consider alternative mitigations such as disabling the vulnerable LINE Webhook functionality if possible, implementing network-level protections to restrict access, or deploying compensating controls to detect and block replay attacks. Monitor vendor channels for any future updates or advisories.