← Back

CVE-2026-42349

nvd nist
Published: May 11, 2026Modified: Jun 17, 2026

JSON object

Loading...
7.6
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Show more
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less
Source: security-advisories@github.com (Secondary)

Description

Clerk JavaScript is the official JavaScript repository for Clerk authentication. has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result should be false, allowing a gated action to proceed for a user who does not satisfy the full set of requested conditions. This call shape can be bypassed if certain conditions are met: a has() or auth.protect() call that combines a reverification check with any of role, permission, feature, or plan, or that combines a billing check (feature or plan) with a role or permission check. This vulnerability is fixed in @clerk/clerk-js 5.125.10 and 6.7.5.

Affected (29)

Clerk
17 products
Clerk/astro
Clerk/backend
Clerk/chrome Extension
Clerk/clerk Expo
Clerk/clerk Js
Clerk/clerk React
Clerk/expo
Clerk/express
Clerk/fastify
Clerk/hono
Clerk/nextjs
Clerk/nuxt
Clerk/react
Clerk/react Router
Clerk/shared
Clerk/tanstack React Start
Clerk/vue
Configuration A
29 vulnerable
Vulnerable SoftwareAffected Versions
Clerk
Clerk/astro
From 2.0.0 to 2.17.11
Clerk/astro
From 3.0.0 to 3.0.18
Clerk
Clerk/backend
From 2.0.0 to 2.33.3
Clerk/backend
From 3.0.0 to 3.2.14
Clerk
Clerk/chrome Extension
From 1.3.5 to 2.9.15
Clerk/chrome Extension
From 3.0.0 to 3.1.15
Clerk/clerk Expo
From 2.2.11 to 2.19.36
Clerk
Clerk/clerk Js
From 5.22.0 to 5.125.10
Clerk/clerk Js
From 6.0.0 to 6.7.5
Clerk/clerk React
From 5.9.0 to 5.61.6
Clerk/expo
From 3.0.0 to 3.2.2
Clerk
Clerk/express
From 0.1.0 to 1.7.79
Clerk/express
From 2.0.0 to 2.1.6
Clerk
Clerk/fastify
From 1.0.42 to 2.6.31
Clerk/fastify
From 3.0.0 to 3.1.16
Clerk/hono
From 0.0.2 to 0.1.16
Clerk
Clerk/nextjs
From 6.0.0 to 6.39.3
Clerk/nextjs
From 7.0.0 to 7.2.4
Clerk
Clerk/nuxt
From 1.0.0 to 1.13.29
Clerk/nuxt
From 2.0.0 to 2.2.5
Clerk/react
From 6.0.0 to 6.4.3
Clerk
Clerk/react Router
From 0.0.1 to 2.4.13
Clerk/react Router
From 3.0.0 to 3.1.4
Clerk
Clerk/shared
From 3.0.0 to 3.47.5
Clerk/shared
From 4.0.0 to 4.8.3
Clerk
Clerk/tanstack React Start
From 0.0.1 to 0.29.11
Clerk/tanstack React Start
From 1.0.0 to 1.1.4
Clerk
Clerk/vue
From 1.0.0 to 1.17.21
Clerk/vue
From 2.0.0 to 2.0.16

Related CWEs

CWE-754
Improper Check for Unusual or Exceptional Conditions
The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
CWE-863
Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (2)

Source: security-advisories@github.com
MitigationVendor Advisory
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
MitigationVendor Advisory

Timeline

No history available yet.