PT-2026-32065

Publicado

2026-03-31

Atualizado

2026-03-31

Descrição por

CVSS 4.0

8.2

Alta

MétricasAV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Summary

Plivo V3 signature verification canonicalized query ordering, but replay detection hashed the raw verification URL. Reordering query parameters preserved a valid signature while producing a fresh replay-cache key.

Impact

An attacker who captured one valid signed Plivo V3 webhook could replay the same event by permuting query parameters and trigger duplicate voice-call processing.

Affected Component

extensions/voice-call/src/webhook-security.ts

Fixed Versions

Affected: <= 2026.3.24
Patched: >= 2026.3.28
Latest stable 2026.3.28 contains the fix.

Fix

Fixed by commit 85777e726c (Voice Call: canonicalize Plivo V3 replay key).

Explorabilidade

Correção

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-294: Authentication Bypass by Capture-replay

Identificadores relacionados

GHSA-8689-GM9G-JGR6

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾

dbugs@ptsecurity.com