Description

A vulnerability was identified in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. Affected is the function get_surge_subscription of the file services/subscription.py of the component Subscription Handler. Such manipulation of the argument key leads to improper access controls. The attack may be launched remotely. The exploit is publicly available and might be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-09-13T10:16:55.720Z",
  "pubdate": "2026-09-13T10:16:55.720Z",
  "executiveSummary": "A critical vulnerability exists in the Subscription Handler component of vvbbnn00 WARP-Clash-API up to commit c7bf2360073959861219b422e51ae86411051b46. The flaw is categorized as an improper access control vulnerability, which stems from the insecure handling of the 'key' argument within the 'get_surge_subscription' function.\nThis vulnerability allows remote, unauthenticated attackers to gain unauthorized access to sensitive subscription data. By manipulating the 'key' parameter, an attacker can bypass existing access restrictions and retrieve information that should be protected. Given the publicly available nature of the exploit and the fact that the project is no longer supported or maintained by the vendor, the risk of exploitation is high.\nThe product operates on a rolling release model, but as it is abandoned, no patches or security updates are forthcoming. Consequently, any deployment of this software remains inherently vulnerable, posing significant risks regarding data exposure and unauthorized subscription information retrieval.",
  "technicalDetails": "The vulnerability resides within the 'get_surge_subscription' function located in 'services/subscription.py'. The root cause is a failure to properly validate or sanitize the 'key' argument before using it to facilitate the retrieval of subscription-related data. The application fails to verify the legitimacy or the ownership of the provided 'key' against the authenticated session or a secure access control list, enabling direct access to data via predictable or brute-forceable key inputs.\nThe attack flow begins with an attacker identifying a target instance of WARP-Clash-API exposed to the network. Since the 'get_surge_subscription' function processes requests remotely without adequate authentication checks or cryptographic verification of the 'key' argument, an attacker can craft a GET request containing a manipulated 'key' value. Upon receipt, the application processes this input within the 'get_surge_subscription' function, which then uses the unsanitized key to index or query the backend storage for subscription details.\nBecause the function does not implement proper authorization logic, it incorrectly assumes the validity of the provided key, returning the requested subscription data directly to the requester. This constitutes an Insecure Direct Object Reference (IDOR) pattern or a similar access control bypass. The impact of this exploit is the complete exposure of sensitive user subscription configurations and potentially associated credentials or endpoints managed by the API. As the exploit is publicly available, attackers can automate the scanning of target endpoints and execute the payload with minimal effort, requiring no special privileges or prior authentication to the application. Given that the maintainer has ceased development and does not provide security patches, the vulnerability remains permanently exploitable, providing an ongoing avenue for information disclosure and data theft for any instance still in production."
}