OpenClaw versions up to 2026.3.28 contain a vulnerability (CVE-2026-41351) that allows bypassing Telnyx webhook replay detection due to Base64 signature re-encoding issues. The flaw causes replay hashing to treat equivalent Telnyx Base64 and Base64URL signatures as distinct, enabling replay attacks despite signature verification still functioning. The issue is fixed in version 2026.3.31.