CVE-2026-90507: vvbbnn00 WARP-Clash-API Subscription subscription.py get_surge_subscription access control
A vulnerability was identified in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. Affected is the function getsurgesubscription of the file services/subscription.py of the component Subscription Handler. Such manipulation of the argument key leads to improper access controls. The attack may be launched remotely. The exploit is publicly available and might be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
The issue affects unsupported WARP-Clash-API products containing the vulnerable Subscription Handler implementation, specifically the get_surge_subscription function in services/subscription.py. Because the project uses a rolling release model, no affected or fixed version range is available.
What does an attacker need to exploit this issue?
An attacker can launch the attack remotely by manipulating the key argument handled by get_surge_subscription. No privileges are required, but user interaction is required according to the supplied severity vector.
Is public exploitation material available?
Yes. A public exploit is available and may be used, increasing the likelihood that exposed instances could be targeted.
What should teams do if they cannot identify a patched release?
The maintainer has not responded to the disclosure, and the affected products are no longer supported. Teams should treat deployments of this unsupported product as potentially affected and prioritize replacing or removing them rather than relying on an identified vendor fix.