Executive brief
WARP-Clash-API is a tool for managing WireGuard VPN and Cloudflare WARP configurations. An authentication flaw in the default configuration allows unauthenticated users to access sensitive account management endpoints without setting up a secret key, potentially exposing private cryptographic keys, cloud bearer tokens, and enabling account takeover.
Technical details
The vulnerability is a missing authentication issue (CWE-306) in the authorized() decorator function. The decorator's logic uses a "fail-open" pattern: when the SECRET_KEY environment variable is unset (empty string), the condition "not SECRET_KEY" evaluates to True, causing the decorator to return without performing any authentication checks. Since the documented setup instructions do not require setting SECRET_KEY, this insecure configuration is the default deployment state. An attacker can remotely access account management endpoints (/account/ paths) without credentials, extracting WireGuard private keys, Cloudflare bearer tokens, license keys, and perform account operations such as key resets or license takeover. The product is archived and no longer maintained, so patches are unavailable.
Affected products
- vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46
Timeline
- 2026-07-18: disclosed: Advisory published on GitHub Gist
- 2026-09-13: advisory: CVE-2026-90504 published