EUVD-2026-76977
GHSA-5436-f3r8-9r98
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with no prerequisites (PR:N, AC:L); impact capped at Low across all three pillars given API scope is proxy configuration only.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability has been found in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. The impacted element is the function authorized. The manipulation of the argument SECRET_KEY leads to missing authentication. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
AnalysisAI
Authentication bypass in vvbbnn00's WARP-Clash-API allows unauthenticated remote attackers to circumvent the authorized function by manipulating the SECRET_KEY argument, gaining unauthorized access to the API's proxy configuration management functions. All versions up to commit c7bf2360073959861219b422e51ae86411051b46 are affected, and no patch exists because the maintainer has abandoned the project and did not respond to disclosure. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The WARP-Clash-API service must be reachable over the network (typically HTTP on a configured port). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score is 5.5 (Medium), with the E:P supplemental modifier reflecting the confirmed public proof-of-concept, which modestly adjusts the effective score downward from a raw 6.9 due to the constrained impact envelope (C:L/I:L/A:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch exists and none is anticipated, as the maintainer is unresponsive and the product is officially end-of-life. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Warp Clash Api
View allImproper access control in WARP-Clash-API (vvbbnn00) allows remote attackers to bypass key-based authorization in the Su
Race condition in vvbbnn00's WARP-Clash-API Save Account Job component allows authenticated low-privilege remote attacke
Race condition in the `doUpdateLicenseKey` function of vvbbnn00/WARP-Clash-API allows authenticated remote attackers wit
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today