Executive Summary

This vulnerability is an authorization bypass issue in multiple Clerk SDK packages, including @clerk/astro, @clerk/backend, and @clerk/chrome-extension. It occurs when certain combined authorization checks using has() or auth.protect() calls incorrectly return true, allowing users to perform actions they are not authorized for.

Specifically, the problem arises when combining reverification checks with role, permission, feature, or plan checks, or when combining billing checks with role or permission checks. This flaw lets a user bypass the intended authorization gates.

The vulnerability does not affect session or token verification, only the combined authorization predicates. It has been fixed in versions @clerk/clerk-js 5.125.10 and 6.7.5.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow unauthorized users to bypass authorization checks and perform actions or access resources they should not be allowed to. This could lead to unauthorized access to sensitive features or data within applications using the affected Clerk SDKs.

While session and token verification remain secure, the flaw in combined authorization checks can compromise confidentiality and integrity of the system by granting improper permissions.

Applications that rely on combined authorization conditions in a single call are particularly at risk unless they upgrade to patched versions or implement workarounds such as splitting combined checks into sequential single-condition checks.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves authorization bypass in Clerk JavaScript SDKs when certain combined authorization checks are used in has() or auth.protect() calls.

Detection involves reviewing your application's use of these functions to identify calls that combine reverification checks with role, permission, feature, or plan checks, or combine billing checks with role or permission checks.

There are no specific network or system commands provided to detect this vulnerability automatically.

A practical approach is to audit your source code for combined authorization predicates in the affected Clerk SDK packages (@clerk/shared, @clerk/nextjs, @clerk/backend, etc.).

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to upgrade all affected Clerk SDK packages to the patched versions: @clerk/clerk-js 5.125.10 or 6.7.5 and corresponding patched versions for other packages.

As a temporary workaround, avoid combining multiple authorization checks in a single has() or auth.protect() call. Instead, split combined checks into sequential single-condition checks.

Review your authorization logic to ensure that no combined checks that could trigger the bypass remain in your codebase until you can upgrade.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthorized users to bypass certain authorization checks, potentially granting access to protected actions or data that they should not have. Such unauthorized access could lead to violations of data protection and privacy requirements mandated by standards like GDPR and HIPAA, which require strict access controls to sensitive personal and health information.

Because the vulnerability impacts confidentiality and integrity by allowing unauthorized access, it may increase the risk of non-compliance with regulations that mandate proper authorization and protection of sensitive data.

However, sessions and token verification remain unaffected, which may mitigate some risk but does not eliminate the compliance concerns arising from authorization bypass.

Users of affected Clerk SDKs are advised to upgrade to patched versions to restore proper authorization enforcement and maintain compliance with relevant standards.

Useful 0 Not Useful 0