# CVE-2026-90506: vvbbnn00 WARP-Clash-API race condition in account management

Source: https://junglewise.ai/threats/cve-2026-90506-vvbbnn00-warp-clash-api-race-condition-in-account-management  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-13. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-90506 · Severity: medium · CVSS 5 · Published 2026-09-13

WARP-Clash-API is a VPN account management tool that synchronizes account data and cryptographic keys with remote servers. A race condition in the background save job can cause concurrent key rotations to be silently reverted, breaking VPN connectivity for users and potentially exposing old or compromised keys to subscriptions generated after the reversion.

Technologies: [Vvbbnn00 WARP-Clash-API](https://junglewise.ai/threats/technologies/warp-clash-api). Vendors: [Vvbbnn00](https://junglewise.ai/threats/vendors/vvbbnn00).

## Quick answers

**Is CVE-2026-90506 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-90506 being exploited in the wild.

**How severe is CVE-2026-90506?** Medium severity, with a CVSS score of 5, published 13 September 2026.

**Which products and versions are affected?** Vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46.

**Is there a fix for CVE-2026-90506?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-90506 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-90506?** Check whether you run Vvbbnn00 WARP-Clash-API at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A TOCTOU (time-of-check-time-of-use) race condition exists in the background saveAccount job, which runs every 120 seconds. The job reads the full account object (including private keys) into memory, performs a network request to refresh usage/quota, then writes the object back to disk. If a concurrent POST /account/reset_key request rotates the key on disk during the saveAccount job's network round-trip, the job will write back stale key data, silently reverting the legitimate key rotation. The vulnerability requires precise timing but no authentication or complex preconditions. An attacker can exploit this to ensure users' subscriptions reference old cryptographic keys, potentially compromising VPN security. The product is no longer maintained and uses a rolling release model, making version information unavailable.

## Affected products

- vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46

## Timeline

- 2026-09-13: disclosed: CVE-2026-90506 published
- 2026-07-18: other: Advisory published on GitHub Gist

## References

- [https://gist.github.com/Galaxync/d09928879331ef9c7e2bfccd08c7288b](https://gist.github.com/Galaxync/d09928879331ef9c7e2bfccd08c7288b)
- [https://vuldb.com/cve/CVE-2026-90506](https://vuldb.com/cve/CVE-2026-90506)

## Related threats

- [vvbbnn00 WARP-Clash-API improper access control in subscription handler](https://junglewise.ai/threats/cve-2026-90507-vvbbnn00-warp-clash-api-improper-access-control-in-subscription)
- [vvbbnn00 WARP-Clash-API race condition in license update](https://junglewise.ai/threats/cve-2026-90505-vvbbnn00-warp-clash-api-race-condition-in-license-update)
- [vvbbnn00 WARP-Clash-API authentication bypass in authorization decorator](https://junglewise.ai/threats/cve-2026-90504-vvbbnn00-warp-clash-api-authentication-bypass-in-authorization)