CVE-2023-0654

3.7 lowEPSS 0.2%

Low (3.7) in cloudflare warp. EPSS 0.2% chance of exploitation in the next 30 days.

Due to a misconfiguration, the WARP Mobile Client (< 6.29) for Android was susceptible to a tapjacking attack. In the event that an attacker built a malicious application and managed to install it on a victim's device, the attacker would be able to trick the user into believing that the app shown on the screen was the WARP client when in reality it was the attacker's app.

Severity

CVSS 3.1

3.7 low

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 12% of CVEs (scores of 2026-10-31)
CWE: CWE-1021
Published: 2023-08-29
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

cloudflare:warp

References

https://developers.cloudflare.com/warp-client/
https://github.com/cloudflare/advisories/security/advisories/GHSA-5r97-pqv6-xpx7
https://developers.cloudflare.com/warp-client/
https://github.com/cloudflare/advisories/security/advisories/GHSA-5r97-pqv6-xpx7

Check your stack JSON