A vulnerability was found in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. (CVE-2026-90505)
A vulnerability was found in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. This affects the function doUpdateLicenseKey. The manipulation results in race condition. The attack can be launched remotely. The attack requires a high level of complexity. The exploitability is reported as difficult. The exploit has been made public and could be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
AI Analysis
Technical Summary
CVE-2026-90505 describes a race condition vulnerability in the doUpdateLicenseKey function of the vvbbnn00 WARP-Clash-API up to commit c7bf2360073959861219b422e51ae86411051b46. The flaw allows remote attackers to manipulate the function under conditions that lead to a race condition. Exploitation requires high complexity and is difficult. The product lacks versioning, so affected versions cannot be precisely identified. The vendor was contacted but did not respond, and the affected product versions are no longer supported.
Potential Impact
Successful exploitation could lead to limited confidentiality, integrity, and availability impacts as indicated by the CVSS vector (C:L/I:L/A:L). However, the exploitability is difficult and requires high complexity. No known exploits are currently in the wild. Since only unsupported product versions are affected, the practical impact is reduced.
Mitigation Recommendations
No official fix or patch is available due to lack of vendor response and the product being unsupported. Users should consider discontinuing use of the affected product or implementing compensating controls to mitigate race condition risks. Monitor for any future vendor advisories or community patches.
A vulnerability was found in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. (CVE-2026-90505)
Description
A vulnerability was found in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. This affects the function doUpdateLicenseKey. The manipulation results in race condition. The attack can be launched remotely. The attack requires a high level of complexity. The exploitability is reported as difficult. The exploit has been made public and could be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS v3.1
Score 5.0medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-90505 describes a race condition vulnerability in the doUpdateLicenseKey function of the vvbbnn00 WARP-Clash-API up to commit c7bf2360073959861219b422e51ae86411051b46. The flaw allows remote attackers to manipulate the function under conditions that lead to a race condition. Exploitation requires high complexity and is difficult. The product lacks versioning, so affected versions cannot be precisely identified. The vendor was contacted but did not respond, and the affected product versions are no longer supported.
Potential Impact
Successful exploitation could lead to limited confidentiality, integrity, and availability impacts as indicated by the CVSS vector (C:L/I:L/A:L). However, the exploitability is difficult and requires high complexity. No known exploits are currently in the wild. Since only unsupported product versions are affected, the practical impact is reduced.
Mitigation Recommendations
No official fix or patch is available due to lack of vendor response and the product being unsupported. Users should consider discontinuing use of the affected product or implementing compensating controls to mitigate race condition risks. Monitor for any future vendor advisories or community patches.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-jj5q-r2mq-29xr
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-90505"]
- Database Specific Severity
- LOW
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aa741a555bf5e2cf5489bf0
Added to database: 09/14/2026, 00:36:53 UTC
Last enriched: 09/14/2026, 00:43:02 UTC
Last updated: 09/14/2026, 03:01:22 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.