Description

A vulnerability has been found in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. The impacted element is the function authorized. The manipulation of the argument SECRET_KEY leads to missing authentication. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-13T10:16:54.093Z",
  "pubdate": "2026-09-13T10:16:54.093Z",
  "executiveSummary": "The WARP-Clash-API, developed by vvbbnn00, contains a critical authentication bypass vulnerability originating from improper handling of the SECRET_KEY parameter within the authorized function.\nThis vulnerability allows unauthenticated, remote attackers to circumvent security controls and gain unauthorized access to the API.\nThe flaw stems from a fundamental design failure in the authentication logic, which fails to correctly validate the provided secret, thereby facilitating unauthorized execution of privileged operations.\nThe vulnerability is currently publicly disclosed and actively exploitable by remote threat actors without requiring prior authentication or specific user interaction.\nGiven the lack of vendor response and the unsupported status of the software, the risk is severe, as no official patches are available to remediate the logic flaw.\nOrganizations relying on this codebase are at high risk of unauthorized data access and complete system compromise through remote manipulation of the affected API endpoints.",
  "technicalDetails": "The vulnerability resides in the authorized function within the WARP-Clash-API codebase, specifically affecting versions up to commit c7bf2360073959861219b422e51ae86411051b46.\nThe root cause is a logic error in the authentication verification routine, where the application incorrectly processes the SECRET_KEY argument provided during the request lifecycle.\nRather than performing a secure, constant-time comparison against a stored secret, the implementation allows the logic to reach an authenticated state through manipulation of this parameter.\nAn attacker can exploit this flaw by sending a specifically crafted HTTP request to the API, effectively bypassing the intended security gatekeeper function.\nSince the authorized function is responsible for protecting critical API endpoints, its bypass grants the attacker the same functional privileges as an authorized user.\nThe attack flow proceeds as follows: First, the attacker identifies a public-facing API endpoint that utilizes the vulnerable authorized function. Second, the attacker interacts with the endpoint by injecting or omitting the SECRET_KEY parameter in a manner that triggers the logic flaw, causing the function to return a successful authentication state regardless of the provided credentials.\nOnce the function validates the malicious request as 'authorized,' the application proceeds to execute subsequent functions or database queries tied to the session. This results in unauthorized administrative access, potential exfiltration of sensitive configuration data, or manipulation of the WARP-Clash environment.\nBecause the vulnerability exists in the core authentication layer, the impact is comprehensive, covering all protected routes defined within the API architecture.\nThe exploitation is entirely remote and requires no privileged access, allowing any network-adjacent or external actor with access to the API port to fully compromise the system.\nPost-exploitation, an attacker can maintain persistent unauthorized access, leverage the API to reconfigure the Clash proxy environment, or extract sensitive proxy configuration details. There is no evidence of remediation within the existing codebase, and because the product is no longer maintained, the vulnerability remains permanently present in all existing deployments."
}