CVE-2026-90507

Name of the Vulnerable Software and Affected Versions vvbbnn00 WARP-Clash-API versions up to c7bf2360073959861219b422e51ae86411051b46

Description Improper access controls exist in the Subscription Handler component. A remote attacker can manipulate the key argument within the get surge subscription() function located in the services/subscription.py file to bypass security restrictions.

Recommendations As a temporary workaround, consider restricting the use of the get surge subscription() function until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.