A critical authentication bypass vulnerability exists in the vvbbnn00 WARP-Clash-API, potentially allowing unauthenticated attackers to hijack accounts and extract sensitive configuration data.

The authorized decorator fails open when the SECRET_KEY environment variable is not explicitly defined. This flaw allows unauthenticated remote attackers to bypass security checks on critical account-management endpoints.

Successful exploitation grants an attacker full access to sensitive credentials, including WireGuard private keys, Cloudflare bearer tokens, and license keys. This allows for unauthorized license takeover and complete compromise of the affected account, posing a severe risk to data confidentiality and service integrity. Given the 7.3 CVSS score, this represents a significant security risk for any environment relying on this software.

Immediate Action: As the project is archived and unsupported, users must immediately discontinue use of this software or migrate to a maintained alternative. If migration is impossible, the application must be firewalled from all external access.

Proactive Monitoring: Review access logs for unauthorized requests to the /account/ endpoints, specifically monitoring for successful requests that lack valid session or authentication headers.

Compensating Controls: Deploy a Web Application Firewall (WAF) or ingress controller rule to restrict access to all /account/ paths to trusted internal IP addresses only.

Public Exploit Available: Yes, a technical write-up containing the exploitation mechanism is published on GitHub.

The vulnerability is severe due to its ease of exploitation and the sensitivity of the exposed data. Because the project is no longer maintained, a patch is not expected. Security teams should prioritize the immediate decommissioning of all instances of WARP-Clash-API to prevent potential account hijacking and data theft.