WARP-Clash-API vulnerabilities

A vulnerability was identified in WARP-Clash-API affecting the get_surge_subscription function in the services/subscription.py file of the Subscription Handler component. Manipulation of the key argument leads to improper access controls. The attack may be launched remotely and the exploit is publicly available.

A vulnerability was determined in WARP-Clash-API affecting an unknown function of the Save Account Job component. Manipulation causes a race condition. The attack may be initiated remotely, but its complexity is rated as high and exploitability is said to be difficult.

A race condition vulnerability was found in the doUpdateLicenseKey function of WARP-Clash-API. The attack can be launched remotely but requires a high level of complexity and exploitability is reported as difficult. The exploit has been made public, and the product is no longer supported by the maintainer.

A vulnerability was found in WARP-Clash-API where the authorized function lacks authentication. Manipulation of the SECRET_KEY argument allows unauthorized remote access. The exploit has been publicly disclosed and may be used.