Log in Start free

Vulnerability · Published May 11, 2026 · Assigned by GitHub_M

CVE-2026-42349Clerk: Authorization bypass when combining organization, billing, or reverification checks

High 7.6

In plain English

A high-severity incorrect authorization in astro from @clerk. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)7.6High
Exploit odds (30 days)0.2%top 84.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Clerk JavaScript is the official JavaScript repository for Clerk authentication. has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result should be false, allowing a gated action to proceed for a user who does not satisfy the full set of requested conditions. This call shape can be bypassed if certain conditions are met: a has() or auth.protect() call that combines a reverification check with any of role, permission, feature, or plan, or that combines a billing check (feature or plan) with a role or permission check. This vulnerability is fixed in @clerk/clerk-js 5.125.10 and 6.7.5.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
npm@clerk/astro2.17.11GHSA-w24r-5266-9c3c
npm@clerk/astro3.0.18GHSA-w24r-5266-9c3c
npm@clerk/backend3.2.14GHSA-w24r-5266-9c3c
npm@clerk/backend2.33.3GHSA-w24r-5266-9c3c
npm@clerk/chrome-extension2.9.15GHSA-w24r-5266-9c3c
npm@clerk/chrome-extension3.1.15GHSA-w24r-5266-9c3c
npm@clerk/clerk-expo2.19.36GHSA-w24r-5266-9c3c
npm@clerk/clerk-js5.125.10GHSA-w24r-5266-9c3c
npm@clerk/clerk-js6.7.5GHSA-w24r-5266-9c3c
npm@clerk/clerk-react5.61.6GHSA-w24r-5266-9c3c
npm@clerk/expo3.2.2GHSA-w24r-5266-9c3c
npm@clerk/express2.1.6GHSA-w24r-5266-9c3c
npm@clerk/express1.7.79GHSA-w24r-5266-9c3c
npm@clerk/fastify2.6.31GHSA-w24r-5266-9c3c
npm@clerk/fastify3.1.16GHSA-w24r-5266-9c3c
npm@clerk/hono0.1.16GHSA-w24r-5266-9c3c
npm@clerk/nextjs7.2.4GHSA-w24r-5266-9c3c
npm@clerk/nextjs6.39.3GHSA-w24r-5266-9c3c
npm@clerk/nuxt1.13.29GHSA-w24r-5266-9c3c
npm@clerk/nuxt2.2.5GHSA-w24r-5266-9c3c
npm@clerk/react6.4.3GHSA-w24r-5266-9c3c
npm@clerk/react-router2.4.13GHSA-w24r-5266-9c3c
npm@clerk/react-router3.1.4GHSA-w24r-5266-9c3c
npm@clerk/shared4.8.3GHSA-w24r-5266-9c3c
npm@clerk/shared3.47.5GHSA-w24r-5266-9c3c
npm@clerk/tanstack-react-start1.1.4GHSA-w24r-5266-9c3c
npm@clerk/tanstack-react-start0.29.11GHSA-w24r-5266-9c3c
npm@clerk/vue2.0.16GHSA-w24r-5266-9c3c
npm@clerk/vue1.17.21GHSA-w24r-5266-9c3c

Affected products (as reported)

VendorProductVersions
clerk javascript >= 5.22.0, < 5.125.10>= 6.0.0, < 6.7.5
@clerk shared >= 3.0.0, <= 3.47.4>= 4.0.0, <= 4.8.2
@clerk backend >= 2.0.0, <= 2.33.2>= 3.0.0, <= 3.2.13
@clerk nextjs >= 6.0.0, <= 6.39.2>= 7.0.0, <= 7.2.3
@clerk clerk-react >= 5.9.0, <= 5.61.5
@clerk react >= 6.0.0, <= 6.4.2
@clerk vue >= 1.0.0, <= 1.17.20>= 2.0.0, <= 2.0.15
@clerk astro >= 2.0.0, <= 2.17.10>= 3.0.0, <= 3.0.17
@clerk nuxt >= 1.0.0, <= 1.13.28>= 2.0.0, <= 2.2.4
@clerk clerk-expo >= 2.2.11, <= 2.19.35
@clerk expo >= 3.0.0, <= 3.2.1
@clerk react-router >= 0.0.1, <= 2.4.12>= 3.0.0, <= 3.1.3
@clerk tanstack-react-start >= 0.0.1, <= 0.29.10>= 1.0.0, <= 1.1.3
@clerk chrome-extension >= 1.3.5, <= 2.9.14>= 3.0.0, <= 3.1.14
@clerk fastify >= 1.0.42, <= 2.6.30>= 3.0.0, <= 3.1.15
@clerk express >= 0.1.0, <= 1.7.78>= 2.0.0, <= 2.1.5
@clerk hono >= 0.0.2, <= 0.1.15

Weakness: CWE-754, CWE-863 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References