EUVD-2026-76979
GHSA-qmhq-94p4-9589
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable race condition requiring authenticated low-privilege access and precise timing; all impacts limited to partial disclosure, corruption, and availability disruption.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was determined in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. This impacts an unknown function of the component Save Account Job. This manipulation causes race condition. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is said to be difficult. The exploit has been publicly disclosed and may be utilized. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
AnalysisAI
Race condition in vvbbnn00's WARP-Clash-API Save Account Job component allows authenticated low-privilege remote attackers to exploit improper synchronization during concurrent account-state operations, yielding limited confidentiality, integrity, and availability impacts. The project has been abandoned by its maintainer, who did not respond to disclosure, and operates on a rolling release model with no versioned releases - meaning no patch will be issued. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to possess valid low-privilege credentials to the target WARP-Clash-API instance, as reflected by PR:L in the CVSS 4.0 vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 1.3 (AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) accurately reflects this vulnerability's genuinely limited real-world risk: network accessibility is offset by high attack complexity and low-privilege prerequisites, and all impact dimensions are capped at Low. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch is available and none is expected, as the maintainer no longer supports this project and did not respond to disclosure. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Warp Clash Api
View allAuthentication bypass in vvbbnn00's WARP-Clash-API allows unauthenticated remote attackers to circumvent the `authorized
Improper access control in WARP-Clash-API (vvbbnn00) allows remote attackers to bypass key-based authorization in the Su
Race condition in the `doUpdateLicenseKey` function of vvbbnn00/WARP-Clash-API allows authenticated remote attackers wit
Same weakness CWE-362 – Race Condition
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today