Warp Clash Api
Monthly
Improper access control in WARP-Clash-API (vvbbnn00) allows remote attackers to bypass key-based authorization in the Surge subscription handler, gaining unauthorized read and write access to subscription data. The affected function is get_surge_subscription in services/subscription.py, where manipulation of the key argument circumvents access control checks. A public proof-of-concept exploit exists on GitHub, and the product is abandoned with no upstream fix available or anticipated.
Race condition in vvbbnn00's WARP-Clash-API Save Account Job component allows authenticated low-privilege remote attackers to exploit improper synchronization during concurrent account-state operations, yielding limited confidentiality, integrity, and availability impacts. The project has been abandoned by its maintainer, who did not respond to disclosure, and operates on a rolling release model with no versioned releases - meaning no patch will be issued. A publicly available proof-of-concept exploit exists on GitHub, though the CVSS 4.0 score of 1.3 and high attack complexity rating indicate that reliable exploitation is difficult in practice.
Race condition in the `doUpdateLicenseKey` function of vvbbnn00/WARP-Clash-API allows authenticated remote attackers with low privileges to exploit concurrent state manipulation for limited confidentiality, integrity, and availability impacts. The affected product is an abandoned, unsupported open-source Cloudflare WARP license key management tool with no versioning scheme and an unresponsive maintainer. A public proof-of-concept exploit exists on GitHub, though the high attack complexity (AC:H) and requirement for prior authentication substantially limit real-world risk.
Authentication bypass in vvbbnn00's WARP-Clash-API allows unauthenticated remote attackers to circumvent the `authorized` function by manipulating the SECRET_KEY argument, gaining unauthorized access to the API's proxy configuration management functions. All versions up to commit c7bf2360073959861219b422e51ae86411051b46 are affected, and no patch exists because the maintainer has abandoned the project and did not respond to disclosure. A public proof-of-concept exploit is available via a GitHub gist, lowering the bar for exploitation against any internet-exposed instance.
Improper access control in WARP-Clash-API (vvbbnn00) allows remote attackers to bypass key-based authorization in the Surge subscription handler, gaining unauthorized read and write access to subscription data. The affected function is get_surge_subscription in services/subscription.py, where manipulation of the key argument circumvents access control checks. A public proof-of-concept exploit exists on GitHub, and the product is abandoned with no upstream fix available or anticipated.
Race condition in vvbbnn00's WARP-Clash-API Save Account Job component allows authenticated low-privilege remote attackers to exploit improper synchronization during concurrent account-state operations, yielding limited confidentiality, integrity, and availability impacts. The project has been abandoned by its maintainer, who did not respond to disclosure, and operates on a rolling release model with no versioned releases - meaning no patch will be issued. A publicly available proof-of-concept exploit exists on GitHub, though the CVSS 4.0 score of 1.3 and high attack complexity rating indicate that reliable exploitation is difficult in practice.
Race condition in the `doUpdateLicenseKey` function of vvbbnn00/WARP-Clash-API allows authenticated remote attackers with low privileges to exploit concurrent state manipulation for limited confidentiality, integrity, and availability impacts. The affected product is an abandoned, unsupported open-source Cloudflare WARP license key management tool with no versioning scheme and an unresponsive maintainer. A public proof-of-concept exploit exists on GitHub, though the high attack complexity (AC:H) and requirement for prior authentication substantially limit real-world risk.
Authentication bypass in vvbbnn00's WARP-Clash-API allows unauthenticated remote attackers to circumvent the `authorized` function by manipulating the SECRET_KEY argument, gaining unauthorized access to the API's proxy configuration management functions. All versions up to commit c7bf2360073959861219b422e51ae86411051b46 are affected, and no patch exists because the maintainer has abandoned the project and did not respond to disclosure. A public proof-of-concept exploit is available via a GitHub gist, lowering the bar for exploitation against any internet-exposed instance.