CVE-2022-3321

Lock WARP switch feature bypass on WARP mobile client for iOS

State: Published
Severity: 6.7 Medium
Published: Oct 28, 2022
Updated: May 8, 2025
Reserved: Sep 26, 2022

Description

It was possible to bypass Lock WARP switch feature https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/warp-settings/#lock-warp-switch on the WARP iOS mobile client by enabling both "Disable for cellular networks" and "Disable for Wi-Fi networks" switches at once in the application settings. Such configuration caused the WARP client to disconnect and allowed the user to bypass restrictions and policies enforced by the Zero Trust platform.

Scores

CVSS	Score	Vector	Source
3.1	6.7 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:L	cloudflare

Weaknesses

CWE-862 Missing Authorization

Affected Products

Product	Versions
WARPCloudflare	before 6.14Affected

References

https://github.com/cloudflare/advisories/security/advisories/GHSA-4463-5p9m-3c78

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.