This vulnerability in vvbbnn00 WARP-Clash-API up to commit c7bf2360073959861219b422e51ae86411051b46 allows remote attackers to bypass access controls by manipulating the argument key in the get_surge_subscription function within services/subscription.py. The product is delivered via a rolling release process, so no explicit versioning information is available. The vendor was contacted but did not provide any response or patch. Exploit code is publicly available, but there is no evidence of active exploitation in the wild. The vulnerability affects only unsupported versions of the product.

Improper access controls can allow unauthorized remote attackers to access or manipulate subscription-related functionality, potentially leading to unauthorized information disclosure or actions within the affected component. The CVSS 4.0 base score is 5.3 (medium), reflecting network attack vector, low complexity, no privileges required, user interaction required, and low impact on confidentiality, integrity, and availability.

No official fix or patch is currently available as the vendor has not responded and the affected product versions are no longer supported. Users should consider discontinuing use of unsupported versions or applying custom access control measures if possible. Monitor vendor channels for any future updates or advisories.