OpenClaw versions prior to 2026.3.31 contain a vulnerability in the Zalo webhook replay cache that allows a cross-target messageId scope bypass. This issue affects authenticated sibling-target delivery paths but does not extend to unauthenticated attackers. The vulnerability has been assigned CVE-2026-41402 and is rated as medium severity with a CVSS score of 4.2. A fix is available in version 2026.3.31.