This vulnerability involves a race condition in the doUpdateLicenseKey function of the vvbbnn00 WARP-Clash-API, allowing remote manipulation under complex conditions. The product lacks versioning, so specific affected versions cannot be determined. The vendor did not respond to disclosure, and the product is no longer maintained. The CVSS 4.0 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, and low impact on confidentiality, integrity, and availability. Exploit code has been made public but exploitation is considered difficult.

The vulnerability could allow an attacker to cause a race condition remotely, potentially leading to unexpected behavior in license key updates. However, the low CVSS score and low impact metrics suggest limited impact on confidentiality, integrity, and availability. No known exploits are currently active in the wild. The product is no longer supported, which may increase risk if exploited.

No official patch or remediation is available due to lack of vendor response and discontinued product support. Users should consider discontinuing use of the affected product or implementing compensating controls to limit exposure. Patch status is not confirmed; check for any future vendor advisories if the product is revived.