CVE-2023-0654: Spoofing User's Activity Loads in WARP Mobile Client (Android)

Severity: low (CVSS 3.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-08-29 · updated 2026-06-17
Weakness: CWE-1021

Description

Due to a misconfiguration, the WARP Mobile Client (< 6.29) for Android was susceptible to a tapjacking attack. In the event that an attacker built a malicious application and managed to install it on a victim's device, the attacker would be able to trick the user into believing that the app shown on the screen was the WARP client when in reality it was the attacker's app.

Affected products

Cloudflare WARP: before 6.29 — fixed in 6.29

How to fix

Upgrade to a fixed version: Cloudflare WARP 6.29. Check the vendor advisory for mitigations.

References

https://developers.cloudflare.com/warp-client/
https://github.com/cloudflare/advisories/security/advisories/GHSA-5r97-pqv6-xpx7
https://developers.cloudflare.com/warp-client/
https://github.com/cloudflare/advisories/security/advisories/GHSA-5r97-pqv6-xpx7

Get alerted when CVE-2023-0654 or the next vulnerability affects your stack