Is CVE-2026-90505 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-90505 being exploited in the wild.

How severe is CVE-2026-90505?

Medium severity, with a CVSS score of 5, published 13 September 2026.

Which products and versions are affected?

Vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46.

Is there a fix for CVE-2026-90505?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-90505 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-90505?

Check whether you run Vvbbnn00 WARP-Clash-API at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-90505: vvbbnn00 WARP-Clash-API race condition in license update

CVE-2026-90505 · Severity: medium · CVSS 5 · Published 2026-09-13

WARP-Clash-API is an open-source utility that integrates with Cloudflare's WARP service. A race condition vulnerability in the license key update function can allow attackers to cause license updates to fail silently or become desynchronized, potentially disrupting service licensing and account authentication. Since this product is no longer maintained, no patches are available.

Technologies: Vvbbnn00 WARP-Clash-API. Vendors: Vvbbnn00.

Quick answers

Is CVE-2026-90505 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-90505 being exploited in the wild.
How severe is CVE-2026-90505?: Medium severity, with a CVSS score of 5, published 13 September 2026.
Which products and versions are affected?: Vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46.
Is there a fix for CVE-2026-90505?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-90505 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-90505?: Check whether you run Vvbbnn00 WARP-Clash-API at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A TOCTOU (time-of-check-time-of-use) race condition exists in the doUpdateLicenseKey function, specifically in the interaction between a local license save and a nested resetAccountKey operation. When multiple concurrent POST /account/update_license requests are sent, the handler saves the new license locally, then calls resetAccountKey, which performs an unsynchronized read-modify-write of the account data. This concurrent interleaving allows stale data to overwrite the saved license, causing a license update that appears successful (HTTP 200) to be silently reverted. Attack requires network access and the ability to send concurrent requests, but is difficult to reliably exploit due to race condition timing constraints. No patch is available as the vendor is unresponsive and the project is archived and unmaintained.

Affected products

vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46

Timeline

2026-07-18: disclosed
2026-09-13: advisory
other: Project archived; vendor unresponsive; no patch available

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.