CVE-2026-90507
Received Received - Intake

Improper Access Control in vvbbnn00 WARP-Clash-API

Publication date: 2026-09-13

Last updated on: 2026-09-13

Assigner: VulDB

Description
A vulnerability was identified in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. Affected is the function get_surge_subscription of the file services/subscription.py of the component Subscription Handler. Such manipulation of the argument key leads to improper access controls. The attack may be launched remotely. The exploit is publicly available and might be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-13
Last Modified
2026-09-13
Generated
2026-09-13
AI Q&A
2026-09-13
EPSS Evaluated
N/A
NVD
CVE-2026-90507
EUVD
EUVD-2026-76980

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
vvbbnn00 warp-clash-api to c7bf2360073959861219b422e51ae86411051b46 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-266 A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an improper access control issue in the WARP-Clash-API project. The function get_surge_subscription in services/subscription.py improperly handles the key argument, allowing manipulation that exposes the SECRET_KEY in URLs of distributed .conf files. This key is a master API credential that, if leaked, enables full account takeover.

Detection Guidance

Check for exposed SECRET_KEY in Surge subscription URLs or .conf files. Search proxy/access logs for key=<SECRET_KEY> patterns. Inspect browser history and config backups for plaintext key exposure.

Impact Analysis

If you use this API, your SECRET_KEY could be exposed in URLs, proxy logs, browser history, or config files. Attackers gaining access to this key can take over your API account entirely, leading to unauthorized access and control of your services.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Exposure of the SECRET_KEY allows full account takeover, which may result in unauthorized data access, processing, or disclosure, triggering compliance breaches.

Mitigation Strategies

Rotate the SECRET_KEY immediately. Disable affected WARP-Clash-API instances if no longer supported. Monitor logs for suspicious API usage. Revoke any exposed credentials.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90507. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart