CVE-2026-90506
Received Received - Intake

Race Condition in WARP-Clash-API Save Account Job

Publication date: 2026-09-13

Last updated on: 2026-09-13

Assigner: VulDB

Description
A vulnerability was determined in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. This impacts an unknown function of the component Save Account Job. This manipulation causes race condition. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is said to be difficult. The exploit has been publicly disclosed and may be utilized. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-13
Last Modified
2026-09-13
Generated
2026-09-13
AI Q&A
2026-09-13
EPSS Evaluated
N/A
NVD
CVE-2026-90506
EUVD
EUVD-2026-76979

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
vvbbnn00 warp-clash-api to c7bf2360073959861219b422e51ae86411051b46 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-362 The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a race condition (CWE-362, TOCTOU) in the WARP-Clash-API project. A background job called saveAccount runs every 120 seconds, reading account data, making a network request to refresh usage details, and writing the updated account back to storage. If a concurrent operation modifies the account's private key during this process, the saveAccount job overwrites the new key with the stale in-memory version, silently reverting legitimate key rotations and breaking WireGuard connectivity.

Detection Guidance

Detecting this race condition requires monitoring for unexpected account key reverts. Check WireGuard logs for sudden loss of connectivity after key rotations. Inspect disk writes to account files during the saveAccount job's 120-second interval. Look for mismatches between in-memory and on-disk key states.

Impact Analysis

This vulnerability can cause loss of WireGuard connectivity for new subscriptions after key rotations. Attackers can exploit it by timing the saveAccount job and a concurrent key reset request to overwrite updated keys with outdated ones, leading to service disruption without detection.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by potentially exposing sensitive account data or disrupting secure communications. A race condition in the saveAccount job may silently revert key rotations, breaking WireGuard connectivity and potentially leading to unauthorized access or data breaches if exploited.

Mitigation Strategies

Disable the saveAccount job temporarily. Replace the vulnerable WARP-Clash-API with a patched version or alternative software. Ensure no concurrent operations modify account keys during background jobs. Monitor for key mismatches or connectivity issues.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90506. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart