CVE-2026-42349
Authorization Bypass in Clerk JavaScript SDK
Publication date: 2026-05-11
Last updated on: 2026-05-11
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| clerk | clerk-js | to 5.125.10 (inc) |
| clerk | clerk-js | to 6.7.5 (inc) |
| clerk | astro | * |
| clerk | backend | * |
| clerk | chrome-extension | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
| CWE-754 | The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows unauthorized users to bypass certain authorization checks, potentially granting access to protected actions or data that they should not have. Such unauthorized access could lead to violations of data protection and privacy requirements mandated by standards like GDPR and HIPAA, which require strict access controls to sensitive personal and health information.
Because the vulnerability impacts confidentiality and integrity by allowing unauthorized access, it may increase the risk of non-compliance with regulations that mandate proper authorization and protection of sensitive data.
However, sessions and token verification remain unaffected, which may mitigate some risk but does not eliminate the compliance concerns arising from authorization bypass.
Users of affected Clerk SDKs are advised to upgrade to patched versions to restore proper authorization enforcement and maintain compliance with relevant standards.
Can you explain this vulnerability to me?
This vulnerability is an authorization bypass issue in multiple Clerk SDK packages, including @clerk/astro, @clerk/backend, and @clerk/chrome-extension. It occurs when certain combined authorization checks using has() or auth.protect() calls incorrectly return true, allowing users to perform actions they are not authorized for.
Specifically, the problem arises when combining reverification checks with role, permission, feature, or plan checks, or when combining billing checks with role or permission checks. This flaw lets a user bypass the intended authorization gates.
The vulnerability does not affect session or token verification, only the combined authorization predicates. It has been fixed in versions @clerk/clerk-js 5.125.10 and 6.7.5.
How can this vulnerability impact me? :
This vulnerability can allow unauthorized users to bypass authorization checks and perform actions or access resources they should not be allowed to. This could lead to unauthorized access to sensitive features or data within applications using the affected Clerk SDKs.
While session and token verification remain secure, the flaw in combined authorization checks can compromise confidentiality and integrity of the system by granting improper permissions.
Applications that rely on combined authorization conditions in a single call are particularly at risk unless they upgrade to patched versions or implement workarounds such as splitting combined checks into sequential single-condition checks.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves authorization bypass in Clerk JavaScript SDKs when certain combined authorization checks are used in has() or auth.protect() calls.
Detection involves reviewing your application's use of these functions to identify calls that combine reverification checks with role, permission, feature, or plan checks, or combine billing checks with role or permission checks.
There are no specific network or system commands provided to detect this vulnerability automatically.
A practical approach is to audit your source code for combined authorization predicates in the affected Clerk SDK packages (@clerk/shared, @clerk/nextjs, @clerk/backend, etc.).
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation is to upgrade all affected Clerk SDK packages to the patched versions: @clerk/clerk-js 5.125.10 or 6.7.5 and corresponding patched versions for other packages.
As a temporary workaround, avoid combining multiple authorization checks in a single has() or auth.protect() call. Instead, split combined checks into sequential single-condition checks.
Review your authorization logic to ensure that no combined checks that could trigger the bypass remain in your codebase until you can upgrade.