This vulnerability in vvbbnn00 WARP-Clash-API up to commit c7bf2360073959861219b422e51ae86411051b46 affects the authorized function. Manipulating the SECRET_KEY argument leads to missing authentication, enabling remote exploitation without privileges or user interaction. Due to the product's continuous delivery model, no specific affected or patched versions are identified. The vendor was contacted but did not respond, and the affected products are no longer maintained. The CVSS 4.0 base score is 6.9, indicating medium severity.

The vulnerability allows remote attackers to bypass authentication by manipulating the SECRET_KEY argument in the authorized function. This could lead to unauthorized access to the API. Since the product is no longer supported, no official fixes or updates are available. The exploit has been publicly disclosed, increasing the risk of exploitation.

No official patch or remediation is available because the affected products are no longer supported and the vendor did not respond to disclosure. Users should consider discontinuing use of the affected API or implementing compensating controls such as network-level restrictions or additional authentication layers to mitigate risk.