The vulnerability in the vvbbnn00 WARP‑Clash‑API allows a remote attacker to bypass authentication by manipulating the SECRET_KEY argument passed to the authorized function. Because the function does not validate or enforce the provided key, an attacker can send requests without proper credentials and gain access to protected API endpoints. This results in unauthorized disclosure of sensitive, as the server treats the request as authenticated. CWE-306, representing improper and missing authentication controls.

The flaw affects the vvbbnn00 WARP‑Clash‑API product on all releases up to commit c7bf2360. No specific version numbers are available, and the vendor has not released a fix. Only versions no longer supported by the maintainer are impacted, so any existing deployment of this product remains vulnerable until a patch or a supported version is installed.

The CVSS score of 6.9 indicates moderate severity, while the EPSS score is reported as less than 1% and the issue is not listed in the CISA KEV catalog. The exploit is publicly disclosed, and the attack is triggered by requests to the authorized endpoint without any additional preconditions. Because there is no patch yet, the risk remains present; the likelihood of exploitation depends on exposure, but the known‑to‑ could be targeted.