CVE-2026-90504: vvbbnn00 WARP-Clash-API authorized missing authentication
A vulnerability has been found in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. The impacted element is the function authorized. The manipulation of the argument SECRETKEY leads to missing authentication. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments of vvbbnn00 WARP-Clash-API that are no longer supported by the maintainer are affected. Because the product uses continuous delivery with rolling releases, the available information does not identify affected or fixed release versions.
What does an attacker need to exploit it?
The issue can be exploited remotely by manipulating the SECRET_KEY argument used by the authorized function. No authentication or user interaction is required according to the provided severity vector.
Is public exploit information available?
Yes. The exploit has been publicly disclosed and may be used.
What should teams do if they cannot identify a patched release?
The vendor did not respond to the disclosure, and no updated release details are available. Organizations using an unsupported deployment should treat it as exposed and plan to replace or retire it rather than relying on a documented vendor fix.