CVE-2026-90504 in WARP-Clash-API
Summary
by MITRE • 09/13/2026
A vulnerability has been found in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. The impacted element is the function authorized. The manipulation of the argument SECRET_KEY leads to missing authentication. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/22/2026
The identified security flaw resides within the vvbbnn00 WARP-Clash-API software, specifically affecting versions up to commit c7bf2360073959861219b422e51ae86411051b46. This vulnerability is categorized as a critical authentication bypass issue stemming from improper handling of the SECRET_KEY argument within the authorized function. The core technical deficiency involves a failure to enforce strict validation or cryptographic verification of the provided secret key, allowing an attacker to manipulate this input parameter in a manner that circumvents the intended access control mechanisms. By exploiting this logic error, an unauthorized entity can effectively disable authentication requirements for specific API endpoints or operations, thereby gaining elevated privileges without valid credentials. This type of flaw is classically associated with CWE-287, which denotes Improper Authentication, and often aligns with ATT&CK technique T1078, Valid Accounts, as it allows an adversary to operate under the guise of a legitimate user session or administrative context despite lacking proper authorization tokens.
The operational impact of this vulnerability is severe due to its remote exploitability. An attacker can initiate the attack from any network location that has connectivity to the target system, requiring no prior access or local foothold on the machine hosting the WARP-Clash-API service. The availability of public exploits significantly lowers the barrier for entry, enabling less sophisticated threat actors to leverage existing proof-of-concept code against vulnerable instances. Since the product utilizes a continuous delivery model with rolling releases, determining the precise version boundaries is challenging as there are no discrete version numbers or specific update patches released by the vendor. This lack of clear versioning complicates vulnerability management efforts for administrators who must rely on commit hashes to identify affected deployments rather than standard semantic versioning schemes.
Furthermore, the risk profile is exacerbated by the fact that this software is no longer supported by its maintainer and has been abandoned. The vendor did not respond to early notifications regarding this disclosure, leaving users without official patches or security updates from the original source. This abandonment means that organizations relying on this tool are operating with known vulnerabilities in a production environment without recourse for remediation through standard update channels. Consequently, mitigation strategies must be implemented at the infrastructure level rather than through software patching. Recommended defensive measures include placing the service behind a reverse proxy or web application firewall capable of inspecting and validating API requests before they reach the vulnerable function. Additionally, implementing strict network segmentation to limit access to only trusted IP ranges can reduce the attack surface. Administrators should also consider migrating away from this unsupported tool to actively maintained alternatives that adhere to modern security standards and provide regular vulnerability management support.