CVE-2026-90507: WARP-Clash-API Auth Bypass Vulnerability

CVE-2026-90507 is an authentication bypass vulnerability in vvbbnn00 WARP-Clash-API affecting the Subscription Handler component. Attackers can exploit improper access controls to gain unauthorized access. This article covers technical details, exploitation methods, impact assessment, and mitigation recommendations.

CVE-2026-90507 Overview

CVE-2026-90507 is an improper access control vulnerability in the open-source vvbbnn00 WARP-Clash-API project. The flaw resides in the get_surge_subscription function within services/subscription.py, part of the Subscription Handler component. Attackers can manipulate the key argument to bypass access controls remotely. The project follows a rolling release model, so no discrete affected or fixed versions exist beyond commit c7bf2360073959861219b422e51ae86411051b46. Public exploit details are available, and the maintainer did not respond to disclosure attempts. This vulnerability affects products no longer supported by the maintainer.

Critical Impact
Remote attackers can bypass subscription access controls in WARP-Clash-API by manipulating the key parameter, exposing subscription configuration data without authentication.

Affected Products

vvbbnn00 WARP-Clash-API up to commit c7bf2360073959861219b422e51ae86411051b46
Component: Subscription Handler (services/subscription.py)
Function: get_surge_subscription

Discovery Timeline

2026-09-13 - CVE-2026-90507 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90507

Vulnerability Analysis

The vulnerability is classified as improper access control [CWE-266]. It exists in the get_surge_subscription function inside services/subscription.py, which handles requests for Surge-format subscription resources. The function accepts a key argument used to authorize subscription retrieval. Insufficient validation of this argument allows unauthorized callers to access resources that should require valid credentials.

Because WARP-Clash-API exposes subscription endpoints over HTTP, the weakness can be reached remotely without prior authentication. Successful exploitation exposes subscription content generated by the service, which may include proxy configuration and routing metadata used by client applications.

Root Cause

The root cause is inadequate enforcement of authorization checks on the key parameter accepted by get_surge_subscription. The handler treats the argument as sufficient proof of access instead of validating it against a trusted authorization boundary. This design allows manipulation of the key value to reach subscription resources outside the caller's intended scope.

Attack Vector

An unauthenticated attacker sends a crafted HTTP request to the subscription endpoint served by the Subscription Handler component. By altering the key argument, the attacker triggers the vulnerable code path in get_surge_subscription and receives subscription data. User interaction is limited to invoking the request, and no privileged position on the network is required. Refer to the GitHub Gist PoC Repository and VulDB CVE-2026-90507 Details for exploitation specifics.

Detection Methods for CVE-2026-90507

Indicators of Compromise

Unexpected HTTP requests to WARP-Clash-API subscription endpoints (Surge subscription paths) from unknown source addresses.
Requests containing anomalous or brute-forced values for the key query argument.
Spikes in subscription response payloads served to clients that never completed provisioning.

Detection Strategies

Enable verbose access logging on the WARP-Clash-API service and alert on repeated requests to the Surge subscription route.
Correlate key argument entropy and cardinality across sessions to identify enumeration or guessing behavior.
Deploy a reverse proxy or WAF rule that inspects subscription endpoint requests and blocks calls lacking a validated session context.

Monitoring Recommendations

Forward web server and application logs into a central analytics platform for retention and query.
Baseline legitimate subscription traffic volumes and alert on deviations that indicate scraping or unauthorized access.
Monitor outbound traffic patterns from clients that consume subscription content to detect misuse of leaked configurations.

How to Mitigate CVE-2026-90507

Immediate Actions Required

Restrict network access to the WARP-Clash-API service, exposing it only to trusted clients through VPN or IP allow-listing.
Rotate any subscription keys previously issued and invalidate cached subscription tokens that may have been enumerated.
Audit historical logs for suspicious requests to get_surge_subscription and identify affected subscribers.

Patch Information

No official patch is available. The project operates on a rolling release model, and the maintainer did not respond to disclosure attempts. The vulnerability affects a product that is no longer supported by the maintainer. Users should consider migrating away from the affected codebase or applying custom access control fixes to services/subscription.py. See VulDB Vulnerability #403095 for advisory tracking.

Workarounds

Place the service behind an authenticating reverse proxy that enforces session validation before requests reach the Subscription Handler.
Implement server-side validation of the key argument against a persisted allow-list of authorized subscribers.
Disable the Surge subscription endpoint if it is not required for production use, reducing the attack surface.

bash

# Configuration example: restrict access with an nginx reverse proxy
location /api/subscription {
    allow 10.0.0.0/8;
    deny all;
    auth_request /_auth;
    proxy_pass http://127.0.0.1:8000;
}