CVE-2026-90504 Overview
CVE-2026-90504 is a missing authentication vulnerability [CWE-287] in the vvbbnn00 WARP-Clash-API project up to commit c7bf2360073959861219b422e51ae86411051b46. The flaw resides in the authorized function, where manipulation of the SECRET_KEY argument allows an attacker to bypass authentication. The issue is remotely exploitable over the network without user interaction. The project uses continuous delivery with rolling releases, so no discrete affected or patched version numbers are published. The vendor was contacted about the disclosure but did not respond, and the affected product is no longer supported by the maintainer.
Critical Impact
Remote attackers can bypass authentication and reach protected API functionality by exploiting the weak SECRET_KEY handling in the authorized function.
Affected Products
- vvbbnn00 WARP-Clash-API up to commit c7bf2360073959861219b422e51ae86411051b46
- Rolling-release deployments of WARP-Clash-API (no versioned releases)
- Product is no longer supported by the maintainer
Discovery Timeline
- 2026-09-13 - CVE-2026-90504 published to the National Vulnerability Database (NVD)
- 2026-09-14 - Last updated in NVD database
Technical Details for CVE-2026-90504
Vulnerability Analysis
The vulnerability sits in the authorized function of WARP-Clash-API, which gates access to protected endpoints. The check relies on comparing a client-supplied value against a SECRET_KEY. Because the check can be manipulated, an unauthenticated remote attacker can be treated as an authorized caller. This exposes API operations that should require valid credentials to network-based abuse.
The weakness is classified under [CWE-287: Improper Authentication]. Exploitation requires only network reachability to the API, no privileges, and no user interaction. Because the project ships via continuous delivery with rolling releases, downstream operators cannot pin remediation to a specific version tag, which complicates asset inventory and patch tracking.
Root Cause
The root cause is insufficient enforcement inside the authorized function. The check permits authentication when the SECRET_KEY argument is manipulated by the caller, indicating either a default or predictable secret, an unsafe comparison, or logic that accepts an attacker-controlled value in place of validated credentials.
Attack Vector
An attacker sends crafted HTTP requests to the WARP-Clash-API endpoint and manipulates the SECRET_KEY parameter used by the authorized function. Because the exploit has been publicly disclosed as a proof of concept, weaponization is straightforward. See the GitHub Gist PoC Code and the VulDB CVE-2026-90504 Entry for technical details.
// No verified exploit code is reproduced here.
// Refer to the linked PoC for the exact request structure.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-90504
Indicators of Compromise
- Unexpected HTTP requests to WARP-Clash-API endpoints that include or reference a SECRET_KEY parameter from untrusted source addresses.
- Successful API responses to clients that never completed a legitimate authentication flow.
- Spikes in configuration or subscription generation requests from single external IP addresses.
Detection Strategies
- Enable verbose access logging on the API layer and alert on authorized code paths invoked without a preceding valid session.
- Correlate requests carrying SECRET_KEY parameters against a known allowlist of administrative sources.
- Deploy a Web Application Firewall (WAF) rule that inspects for public PoC signatures referenced in the GitHub Gist PoC Code.
Monitoring Recommendations
- Monitor egress and reverse-proxy logs for anomalous request volume against WARP-Clash-API hosts.
- Track authentication decisions returned by the authorized function and alert on high acceptance rates from new IP ranges.
- Feed API access telemetry into a centralized SIEM for retrospective hunting against the disclosure date.
How to Mitigate CVE-2026-90504
Immediate Actions Required
- Restrict network exposure of WARP-Clash-API instances to trusted management networks or VPNs.
- Rotate any static SECRET_KEY values and replace defaults with high-entropy secrets stored outside source control.
- Place the API behind an authenticating reverse proxy that enforces its own access controls.
Patch Information
No official patch is available. The maintainer no longer supports the product, and the vendor did not respond to disclosure attempts documented in the VulDB CVE-2026-90504 Entry. Operators should plan migration away from WARP-Clash-API or maintain a private fork with hardened authentication.
Workarounds
- Terminate exposed WARP-Clash-API deployments and replace them with a maintained alternative.
- Apply IP allowlisting at the load balancer or firewall to block untrusted callers from reaching the API.
- Introduce an authenticating reverse proxy (for example, an OAuth2 or mTLS gateway) in front of the service.
- Audit repositories and container images for leaked or default SECRET_KEY values and remove them.
# Example: restrict WARP-Clash-API to a management CIDR using iptables
iptables -A INPUT -p tcp --dport 8000 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8000 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
