CVE-2026-90504
Received Received - Intake

Authentication Bypass in vvbbnn00 WARP-Clash-API

Publication date: 2026-09-13

Last updated on: 2026-09-13

Assigner: VulDB

Description
A vulnerability has been found in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. The impacted element is the function authorized. The manipulation of the argument SECRET_KEY leads to missing authentication. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-13
Last Modified
2026-09-13
Generated
2026-09-13
AI Q&A
2026-09-13
EPSS Evaluated
N/A
NVD
CVE-2026-90504
EUVD
EUVD-2026-76977

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
vvbbnn00 warp-clash-api to c7bf2360073959861219b422e51ae86411051b46 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authentication bypass in the WARP-Clash-API project. The authorized() function fails to enforce authentication when the SECRET_KEY environment variable is not set, defaulting to an empty string. This allows remote attackers to access sensitive endpoints without authentication, potentially exposing WireGuard private keys, Cloudflare tokens, and license keys.

Detection Guidance

Check if the WARP-Clash-API service is running without a SECRET_KEY environment variable set. Inspect environment variables with commands like 'env | grep SECRET_KEY' or 'ps aux | grep warp-clash-api'. Verify if unauthenticated requests to sensitive endpoints like account management or key reset are possible.

Impact Analysis

Attackers can remotely access sensitive account-management functions without authentication. This may lead to exposure or theft of private keys, tokens, and license keys. Attackers could reset keys or take over licenses, compromising the security of the system and associated services.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating confidentiality requirements in GDPR and HIPAA. Exposure of sensitive keys and tokens may result in non-compliance with data protection and security standards.

Mitigation Strategies

Set a strong SECRET_KEY environment variable for WARP-Clash-API to enforce authentication. Disable or remove the service if it is no longer supported. Block external access to sensitive endpoints until patched or mitigated.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90504. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart