Vulnerability in Vvbbnn00 Warp-Clash-Api
CVE-2026-90505
A vulnerability was found in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. This affects the function doUpdateLicenseKey. The manipulation results in race condition. The attack can be launched remotely. The attack requires a high level of complexity. The exploitability is reported as difficult. The exploit has been made public and could be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
Vulnerability class: Race Condition
CVSS v3 metric
CVSS v3 base score 5.0 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L.
Affected products
- Vvbbnn00 Warp-clash-api — versions c7bf2360073959861219b422e51ae86411051b46
Weakness classification (CWE)
References
- cna@vuldb.com (technical-description, vdb-entry)
- cna@vuldb.com (signature, permissions-required)
- cna@vuldb.com (third-party-advisory)
- cna@vuldb.com (third-party-advisory)
- cna@vuldb.com (exploit)
Frequently asked questions
- What is CVE-2026-90505?
- CVE-2026-90505 is a medium-severity vulnerability in Vvbbnn00 Warp-Clash-Api, classified under Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition). CVSS score: 5.0/10. Published 2026-09-13.
- How severe is CVE-2026-90505?
- Medium severity. CVSS v3 base score is 5.0 out of 10.