vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46 Subscription services/subscription.py get_surge_subscription key access control

Summaryinfo

A vulnerability was found in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. It has been rated as critical. Affected by this vulnerability is the function get_surge_subscription of the file services/subscription.py of the component Subscription Handler. Performing a manipulation of the argument key results in access control. This vulnerability only affects products that are no longer supported by the maintainer. This vulnerability is known as CVE-2026-90507. Remote exploitation of the attack is possible. Furthermore, an exploit is available. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.

Detailsinfo

A vulnerability, which was classified as critical, was found in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. This affects the function get_surge_subscription of the file services/subscription.py of the component Subscription Handler. The manipulation of the argument key with an unknown input leads to a access control vulnerability. CWE is classifying the issue as CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. This is going to have an impact on confidentiality, integrity, and availability.

It is possible to read the advisory at gist.github.com. This vulnerability is uniquely identified as CVE-2026-90507. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Technical details and a public exploit are known. The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

The exploit is shared for download at gist.github.com. It is declared as proof-of-concept. The vendor was contacted early about this disclosure but did not respond in any way.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Automation Software

Vendor

• vvbbnn00

Name

• WARP-Clash-API

Version

• c7bf2360073959861219b422e51ae86411051b46

Support

• end of life

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #895270: vvbbnn00 (https://github.com/vvbbnn00) WARP-Clash-API latest (main/master branch) CWE-284 (Improper Access Control / Broken Access Control - autho (by Galaxyn)

Be aware that VulDB is the high quality source for vulnerability data.

Discussion