CVE-2026-26319

Description: TelnyxProvider.verifyWebhook() fails open. When publicKey is unset it returns { ok: true } before reaching any signature check, so an HTTP POST to the voice-call webhook flows through handleRequest() into parseWebhookEvent() and processEvent() with no verification at all:

verifyWebhook(ctx: WebhookContext): WebhookVerificationResult {
  if (!this.publicKey) {
    // No public key configured, skip verification (not recommended for production)
    return { ok: true };
  }
  const signature = ctx.headers["telnyx-signature-ed25519"];
  // …never reached
}

The comment acknowledges the risk and the default configuration ships into it. Affects openclaw before 2026.2.14.

Impact: Unauthenticated webhook processing. Any caller who can reach the endpoint drives voice-call event handling as though Telnyx had signed the request.

Found by Endor Labs AI SAST tracing the data flow from the webhook route to the fail-open return.