CVE-2026-90505
Received Received - Intake

Race Condition in WARP-Clash-API

Publication date: 2026-09-13

Last updated on: 2026-09-13

Assigner: VulDB

Description
A vulnerability was found in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. This affects the function doUpdateLicenseKey. The manipulation results in race condition. The attack can be launched remotely. The attack requires a high level of complexity. The exploitability is reported as difficult. The exploit has been made public and could be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-13
Last Modified
2026-09-13
Generated
2026-09-13
AI Q&A
2026-09-13
EPSS Evaluated
N/A
NVD
CVE-2026-90505
EUVD
EUVD-2026-76978

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
vvbbnn00 warp-clash-api to c7bf2360073959861219b422e51ae86411051b46 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-362 The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a race condition (CWE-362, TOCTOU) in the WARP-Clash-API product. It occurs in the doUpdateLicenseKey function where a local license save followed by an unsynchronized resetAccountKey operation creates a race window. Concurrent requests can desynchronize the local license key from Cloudflare's registered license or silently revert a successful update.

Detection Guidance

Detecting this race condition vulnerability requires monitoring for concurrent license update requests to the /account/update_license endpoint. Check server logs for multiple rapid POST requests from the same or different sources targeting this path. Look for HTTP 200 responses followed by unexpected license state changes or inconsistencies between local and Cloudflare-registered licenses.

Impact Analysis

An attacker could exploit this by sending multiple concurrent POST requests to /account/update_license. This may overwrite stale data, causing the license update to appear successful (HTTP 200) while actually being reverted. This could lead to unauthorized access or service disruption if license validation fails.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it is a technical flaw in a discontinued product. However, race conditions could lead to unauthorized data access or integrity issues, which may violate GDPR principles like integrity and confidentiality or HIPAA's security rule if exploited in a healthcare context.

Mitigation Strategies

Immediately disable the WARP-Clash-API service if it is no longer supported by the maintainer. Block external access to the /account/update_license endpoint at the network perimeter. If continued use is required, implement rate limiting and request serialization to prevent concurrent updates. Migrate to a supported alternative as soon as possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90505. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart