EUVD-2026-76978
GHSA-jj5q-r2mq-29xr
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable race condition requiring low-privilege auth and high timing complexity; all impacts limited to the vulnerable system only.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was found in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. This affects the function doUpdateLicenseKey. The manipulation results in race condition. The attack can be launched remotely. The attack requires a high level of complexity. The exploitability is reported as difficult. The exploit has been made public and could be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
AnalysisAI
Race condition in the doUpdateLicenseKey function of vvbbnn00/WARP-Clash-API allows authenticated remote attackers with low privileges to exploit concurrent state manipulation for limited confidentiality, integrity, and availability impacts. The affected product is an abandoned, unsupported open-source Cloudflare WARP license key management tool with no versioning scheme and an unresponsive maintainer. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) low-privilege authenticated access to the WARP-Clash-API instance (PR:L per CVSS vector); (2) the ability to issue concurrent network requests to the `doUpdateLicenseKey` function (AV:N); (3) high attack complexity (AC:H) - a precise timing window must be hit between concurrent invocations, making reliable exploitation difficult. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 1.3 accurately reflects the constrained real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch identified at time of analysis, and none is anticipated given the product's end-of-life and unresponsive maintainer status. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Warp Clash Api
View allAuthentication bypass in vvbbnn00's WARP-Clash-API allows unauthenticated remote attackers to circumvent the `authorized
Improper access control in WARP-Clash-API (vvbbnn00) allows remote attackers to bypass key-based authorization in the Su
Race condition in vvbbnn00's WARP-Clash-API Save Account Job component allows authenticated low-privilege remote attacke
Same weakness CWE-362 – Race Condition
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today