Executive brief
WARP-Clash-API is an open-source utility that integrates with Cloudflare's WARP service. A race condition vulnerability in the license key update function can allow attackers to cause license updates to fail silently or become desynchronized, potentially disrupting service licensing and account authentication. Since this product is no longer maintained, no patches are available.
Technical details
A TOCTOU (time-of-check-time-of-use) race condition exists in the doUpdateLicenseKey function, specifically in the interaction between a local license save and a nested resetAccountKey operation. When multiple concurrent POST /account/update_license requests are sent, the handler saves the new license locally, then calls resetAccountKey, which performs an unsynchronized read-modify-write of the account data. This concurrent interleaving allows stale data to overwrite the saved license, causing a license update that appears successful (HTTP 200) to be silently reverted. Attack requires network access and the ability to send concurrent requests, but is difficult to reliably exploit due to race condition timing constraints. No patch is available as the vendor is unresponsive and the project is archived and unmaintained.
Affected products
- vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46
Timeline
- 2026-07-18: disclosed
- 2026-09-13: advisory
- other: Project archived; vendor unresponsive; no patch available