Executive brief
WARP-Clash-API is a VPN account management tool that synchronizes account data and cryptographic keys with remote servers. A race condition in the background save job can cause concurrent key rotations to be silently reverted, breaking VPN connectivity for users and potentially exposing old or compromised keys to subscriptions generated after the reversion.
Technical details
A TOCTOU (time-of-check-time-of-use) race condition exists in the background saveAccount job, which runs every 120 seconds. The job reads the full account object (including private keys) into memory, performs a network request to refresh usage/quota, then writes the object back to disk. If a concurrent POST /account/reset_key request rotates the key on disk during the saveAccount job's network round-trip, the job will write back stale key data, silently reverting the legitimate key rotation. The vulnerability requires precise timing but no authentication or complex preconditions. An attacker can exploit this to ensure users' subscriptions reference old cryptographic keys, potentially compromising VPN security. The product is no longer maintained and uses a rolling release model, making version information unavailable.
Affected products
- vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46
Timeline
- 2026-09-13: disclosed: CVE-2026-90506 published
- 2026-07-18: other: Advisory published on GitHub Gist