Clerk: Authorization bypass when combining organization, billing, or reverification checks
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 5.125.10, 6.7.5, 3.47.5, 4.8.3, 2.33.3, and 24 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: poc
- Automatable: no
- Technical impact: partial
Summary
Clerk JavaScript is the official JavaScript repository for Clerk authentication. has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result should be false, allowing a gated action to proceed for a user who does not satisfy the full set of requested conditions. This call shape can be bypassed if certain conditions are met: a has() or auth.protect() call that combines a reverification check with any of role, permission, feature, or plan, or that combines a billing check (feature or plan) with a role or permission check. This vulnerability is fixed in @clerk/clerk-js 5.125.10 and 6.7.5.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: poc · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- clerk javascript
From 5.22.0 · fixed in 5.125.10; From 6.0.0 · fixed in 6.7.5
- @clerk shared
From 3.0.0 · through 3.47.4; From 4.0.0 · through 4.8.2
- @clerk backend
From 2.0.0 · through 2.33.2; From 3.0.0 · through 3.2.13
- @clerk nextjs
From 6.0.0 · through 6.39.2; From 7.0.0 · through 7.2.3
- @clerk clerk-react
From 5.9.0 · through 5.61.5
- @clerk react
From 6.0.0 · through 6.4.2
- @clerk vue
From 1.0.0 · through 1.17.20; From 2.0.0 · through 2.0.15
- @clerk astro
From 2.0.0 · through 2.17.10; From 3.0.0 · through 3.0.17
- @clerk nuxt
From 1.0.0 · through 1.13.28; From 2.0.0 · through 2.2.4
- @clerk clerk-expo
From 2.2.11 · through 2.19.35
- @clerk expo
From 3.0.0 · through 3.2.1
- @clerk react-router
From 0.0.1 · through 2.4.12; From 3.0.0 · through 3.1.3
- @clerk tanstack-react-start
From 0.0.1 · through 0.29.10; From 1.0.0 · through 1.1.3
- @clerk chrome-extension
From 1.3.5 · through 2.9.14; From 3.0.0 · through 3.1.14
- @clerk fastify
From 1.0.42 · through 2.6.30; From 3.0.0 · through 3.1.15
- @clerk express
From 0.1.0 · through 1.7.78; From 2.0.0 · through 2.1.5
- @clerk hono
From 0.0.2 · through 0.1.15
- @clerk/sharednpm
From 3.0.0 · fixed in 3.47.5
- @clerk/sharednpm
From 4.0.0 · fixed in 4.8.3
- @clerk/backendnpm
From 2.0.0 · fixed in 2.33.3
- @clerk/backendnpm
From 3.0.0 · fixed in 3.2.14
- @clerk/nextjsnpm
From 6.0.0 · fixed in 6.39.3
- @clerk/nextjsnpm
From 7.0.0 · fixed in 7.2.4
- @clerk/clerk-jsnpm
From 5.22.0 · fixed in 5.125.10
- @clerk/clerk-jsnpm
From 6.0.0 · fixed in 6.7.5
- @clerk/clerk-reactnpm
From 5.9.0 · fixed in 5.61.6
- @clerk/reactnpm
From 6.0.0 · fixed in 6.4.3
- @clerk/vuenpm
From 1.0.0 · fixed in 1.17.21
- @clerk/vuenpm
From 2.0.0 · fixed in 2.0.16
- @clerk/astronpm
From 2.0.0 · fixed in 2.17.11
- @clerk/astronpm
From 3.0.0 · fixed in 3.0.18
- @clerk/nuxtnpm
From 1.0.0 · fixed in 1.13.29
- @clerk/nuxtnpm
From 2.0.0 · fixed in 2.2.5
- @clerk/clerk-exponpm
From 2.2.11 · fixed in 2.19.36
- @clerk/exponpm
From 3.0.0 · fixed in 3.2.2
- @clerk/react-routernpm
From 0.0.1 · fixed in 2.4.13
- @clerk/react-routernpm
From 3.0.0 · fixed in 3.1.4
- @clerk/tanstack-react-startnpm
From 0.0.1 · fixed in 0.29.11
- @clerk/tanstack-react-startnpm
From 1.0.0 · fixed in 1.1.4
- @clerk/chrome-extensionnpm
From 1.3.5 · fixed in 2.9.15
- @clerk/chrome-extensionnpm
From 3.0.0 · fixed in 3.1.15
- @clerk/fastifynpm
From 1.0.42 · fixed in 2.6.31
- @clerk/fastifynpm
From 3.0.0 · fixed in 3.1.16
- @clerk/expressnpm
From 0.1.0 · fixed in 1.7.79
- @clerk/expressnpm
From 2.0.0 · fixed in 2.1.6
- @clerk/hononpm
From 0.0.2 · fixed in 0.1.16