A vulnerability has been found in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. (CVE-2026-90504)
A vulnerability has been found in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. The impacted element is the function authorized. The manipulation of the argument SECRET_KEY leads to missing authentication. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
AI Analysis
Technical Summary
CVE-2026-90504 describes an authentication bypass vulnerability in the vvbbnn00 WARP-Clash-API, specifically in the authorized function. Manipulating the SECRET_KEY argument causes missing authentication, allowing remote attackers to bypass security controls. The product employs continuous delivery with rolling releases, preventing precise version identification. The vendor was contacted but did not provide any response or patch. The vulnerability affects only unsupported versions of the product.
Potential Impact
The vulnerability allows remote attackers to bypass authentication by manipulating the SECRET_KEY argument, potentially leading to unauthorized access with limited confidentiality, integrity, and availability impacts as indicated by the CVSS vector (C:L/I:L/A:L). Since the product versions affected are no longer supported, users remain exposed without official remediation.
Mitigation Recommendations
No official fix or patch is available due to lack of vendor response and the product being unsupported. Users should consider discontinuing use of affected versions or implementing compensating controls to restrict access to the vulnerable API. Monitor for any future vendor advisories or community patches.
A vulnerability has been found in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. (CVE-2026-90504)
Description
A vulnerability has been found in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. The impacted element is the function authorized. The manipulation of the argument SECRET_KEY leads to missing authentication. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS v3.1
Score 7.3high
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-90504 describes an authentication bypass vulnerability in the vvbbnn00 WARP-Clash-API, specifically in the authorized function. Manipulating the SECRET_KEY argument causes missing authentication, allowing remote attackers to bypass security controls. The product employs continuous delivery with rolling releases, preventing precise version identification. The vendor was contacted but did not provide any response or patch. The vulnerability affects only unsupported versions of the product.
Potential Impact
The vulnerability allows remote attackers to bypass authentication by manipulating the SECRET_KEY argument, potentially leading to unauthorized access with limited confidentiality, integrity, and availability impacts as indicated by the CVSS vector (C:L/I:L/A:L). Since the product versions affected are no longer supported, users remain exposed without official remediation.
Mitigation Recommendations
No official fix or patch is available due to lack of vendor response and the product being unsupported. Users should consider discontinuing use of affected versions or implementing compensating controls to restrict access to the vulnerable API. Monitor for any future vendor advisories or community patches.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-5436-f3r8-9r98
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-90504"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aa741a755bf5e2cf5489bf6
Added to database: 09/14/2026, 00:36:55 UTC
Last enriched: 09/14/2026, 00:43:17 UTC
Last updated: 09/14/2026, 04:01:22 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.