Missing Authentication in WARP-Clash-API SECRET_KEY Validation

A vulnerability has been found in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. The impacted element is the function authorized. The manipulation of the argument SECRET_KEY leads to missing authentication. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-90504 exposes a critical authentication bypass in the vvbbnn00 WARP-Clash-API where the SECRET_KEY parameter can be manipulated to bypass authorization checks entirely. This vulnerability allows unauthenticated remote attackers to gain unauthorized access to protected functions, potentially compromising API integrity and sensitive operations. Organizations using WARP-Clash-API in their infrastructure are immediately at risk, particularly those relying on this component for secure inter-service communication or user session management. The public disclosure and active exploit availability mean threat actors are likely already probing for vulnerable instances.

Casky's 283 mapped security skills detect the attack patterns underlying this vulnerability by analyzing MITRE ATT&CK techniques TA0004 (Privilege Escalation) and TA0006 (Credential Access). Practitioners using Casky would observe findings related to improper authentication implementation (CWE-287) and missing authorization checks (CWE-306)—specifically detecting API calls with manipulated SECRET_KEY parameters that bypass the authorized() function validation. Claude's extended reasoning capabilities help security teams correlate suspicious authentication patterns, identify lateral movement attempts following initial bypass, and distinguish legitimate API traffic from exploitation attempts. Practitioners would see flagged authentication anomalies, failed authorization enforcement, and potential privilege escalation attempts in their Casky dashboard, enabling rapid incident response and threat hunting across their WARP-Clash-API deployments.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-90504.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-90504

Casky has 283 skills that investigate the attack patterns behind CVE-2026-90504. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn