CVE-2026-42349

Published: May 11, 2026Modified: Oct 26, 2026

7.6

Vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: security-advisories@github.com (Secondary)

Description

Clerk JavaScript is the official JavaScript repository for Clerk authentication. has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result should be false, allowing a gated action to proceed for a user who does not satisfy the full set of requested conditions. This call shape can be bypassed if certain conditions are met: a has() or auth.protect() call that combines a reverification check with any of role, permission, feature, or plan, or that combines a billing check (feature or plan) with a role or permission check. This vulnerability is fixed in @clerk/clerk-js 5.125.10 and 6.7.5.

Affected (29)

Products: Clerk: Clerk/astro, Clerk/backend, Clerk/chrome Extension, Clerk/clerk Expo, Clerk/clerk Js, Clerk/clerk React, Clerk/expo, Clerk/express, Clerk/fastify, Clerk/hono, Clerk/nextjs, Clerk/nuxt, Clerk/react, Clerk/react Router, Clerk/shared, Clerk/tanstack React Start, Clerk/vue

Clerk

17 products

Clerk/astro

Clerk/backend

Clerk/chrome Extension

Clerk/tanstack React Start

Clerk/vue

Configuration A

29 vulnerable

Vulnerable Software	Affected Versions
Clerk Clerk/astro	2.0.0 ≤ version < 2.17.11
Clerk Clerk/astro	3.0.0 ≤ version < 3.0.18
Clerk Clerk/backend	2.0.0 ≤ version < 2.33.3
Clerk Clerk/backend	3.0.0 ≤ version < 3.2.14
Clerk Clerk/chrome Extension	1.3.5 ≤ version < 2.9.15
Clerk Clerk/chrome Extension	3.0.0 ≤ version < 3.1.15
Clerk Clerk/clerk Expo	2.2.11 ≤ version < 2.19.36
Clerk Clerk/clerk Js	5.22.0 ≤ version < 5.125.10
Clerk Clerk/clerk Js	6.0.0 ≤ version < 6.7.5
Clerk Clerk/clerk React	5.9.0 ≤ version < 5.61.6
Clerk Clerk/expo	3.0.0 ≤ version < 3.2.2
Clerk Clerk/express	0.1.0 ≤ version < 1.7.79
Clerk Clerk/express	2.0.0 ≤ version < 2.1.6
Clerk Clerk/fastify	1.0.42 ≤ version < 2.6.31
Clerk Clerk/fastify	3.0.0 ≤ version < 3.1.16
Clerk Clerk/hono	0.0.2 ≤ version < 0.1.16
Clerk Clerk/nextjs	6.0.0 ≤ version ≤ 6.39.3
Clerk Clerk/nextjs	7.0.0 ≤ version < 7.2.4
Clerk Clerk/nuxt	1.0.0 ≤ version < 1.13.29
Clerk Clerk/nuxt	2.0.0 ≤ version < 2.2.5
Clerk Clerk/react	6.0.0 ≤ version < 6.4.3
Clerk Clerk/react Router	0.0.1 ≤ version < 2.4.13
Clerk Clerk/react Router	3.0.0 ≤ version < 3.1.4
Clerk Clerk/shared	3.0.0 ≤ version < 3.47.5
Clerk Clerk/shared	4.0.0 ≤ version < 4.8.3
Clerk Clerk/tanstack React Start	0.0.1 ≤ version < 0.29.11
Clerk Clerk/tanstack React Start	1.0.0 ≤ version < 1.1.4
Clerk Clerk/vue	1.0.0 ≤ version < 1.17.21
Clerk Clerk/vue	2.0.0 ≤ version < 2.0.16

Related CWEs

CWE-754

Improper Check for Unusual or Exceptional Conditions

The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.

CWE-863

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (2)

https://github.com/clerk/javascript/security/advisories/GHSA-w24r-5266-9c3c

Source: security-advisories@github.com

MitigationVendor Advisory

https://github.com/clerk/javascript/security/advisories/GHSA-w24r-5266-9c3c

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

MitigationVendor Advisory

Timeline

No history available yet.