{"id":"CVE-2026-42349","revision":"333ea7f732494ac2b39dabfa37c96ef6","records":[{"revision":"333ea7f732494ac2b39dabfa37c96ef6","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-42349","aliases":[],"title":"Clerk: Authorization bypass when combining organization, billing, or reverification checks","description":"Clerk JavaScript is the official JavaScript repository for Clerk authentication. has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result should be false, allowing a gated action to proceed for a user who does not satisfy the full set of requested conditions. This call shape can be bypassed if certain conditions are met: a has() or auth.protect() call that combines a reverification check with any of role, permission, feature, or plan, or that combines a billing check (feature or plan) with a role or permission check. This vulnerability is fixed in @clerk/clerk-js 5.125.10 and 6.7.5.","state":0,"publishedAt":"2026-05-11T16:08:27.869+00:00","modifiedAt":"2026-05-14T18:19:38.735+00:00","affected":[{"ecosystem":"Vendor product","name":"javascript","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"clerk\",\n \"product\": \"javascript\",\n \"versions\": [\n {\n \"version\": \">= 5.22.0, < 5.125.10\",\n \"status\": \"affected\"\n },\n {\n \"version\": \">= 6.0.0, < 6.7.5\",\n \"status\": \"affected\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"shared","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"@clerk\",\n \"product\": \"shared\",\n \"versions\": [\n {\n \"version\": \">= 3.0.0, <= 3.47.4\",\n \"status\": \"affected\"\n },\n {\n \"version\": \">= 4.0.0, <= 4.8.2\",\n \"status\": \"affected\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"backend","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"@clerk\",\n \"product\": \"backend\",\n \"versions\": [\n {\n \"version\": \">= 2.0.0, <= 2.33.2\",\n \"status\": \"affected\"\n },\n {\n \"version\": \">= 3.0.0, <= 3.2.13\",\n \"status\": \"affected\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"nextjs","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"@clerk\",\n \"product\": \"nextjs\",\n \"versions\": [\n {\n \"version\": \">= 6.0.0, <= 6.39.2\",\n \"status\": \"affected\"\n },\n {\n \"version\": \">= 7.0.0, <= 7.2.3\",\n \"status\": \"affected\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"clerk-react","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"@clerk\",\n \"product\": \"clerk-react\",\n \"versions\": [\n {\n \"version\": \">= 5.9.0, <= 5.61.5\",\n \"status\": \"affected\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"react","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"@clerk\",\n \"product\": \"react\",\n \"versions\": [\n {\n \"version\": \">= 6.0.0, <= 6.4.2\",\n \"status\": \"affected\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"vue","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"@clerk\",\n \"product\": \"vue\",\n \"versions\": [\n {\n \"version\": \">= 1.0.0, <= 1.17.20\",\n \"status\": \"affected\"\n },\n {\n \"version\": \">= 2.0.0, <= 2.0.15\",\n \"status\": \"affected\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"astro","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"@clerk\",\n \"product\": \"astro\",\n \"versions\": [\n {\n \"version\": \">= 2.0.0, <= 2.17.10\",\n \"status\": \"affected\"\n },\n {\n \"version\": \">= 3.0.0, <= 3.0.17\",\n \"status\": \"affected\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"nuxt","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"@clerk\",\n \"product\": \"nuxt\",\n \"versions\": [\n {\n \"version\": \">= 1.0.0, <= 1.13.28\",\n \"status\": \"affected\"\n },\n {\n \"version\": \">= 2.0.0, <= 2.2.4\",\n \"status\": \"affected\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"clerk-expo","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"@clerk\",\n \"product\": \"clerk-expo\",\n \"versions\": [\n {\n \"version\": \">= 2.2.11, <= 2.19.35\",\n \"status\": \"affected\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"expo","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"@clerk\",\n \"product\": \"expo\",\n \"versions\": [\n {\n \"version\": \">= 3.0.0, <= 3.2.1\",\n \"status\": \"affected\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"react-router","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"@clerk\",\n \"product\": \"react-router\",\n \"versions\": [\n {\n \"version\": \">= 0.0.1, <= 2.4.12\",\n \"status\": \"affected\"\n },\n {\n \"version\": \">= 3.0.0, <= 3.1.3\",\n \"status\": \"affected\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"tanstack-react-start","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"@clerk\",\n \"product\": \"tanstack-react-start\",\n \"versions\": [\n {\n \"version\": \">= 0.0.1, <= 0.29.10\",\n \"status\": \"affected\"\n },\n {\n \"version\": \">= 1.0.0, <= 1.1.3\",\n \"status\": \"affected\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"chrome-extension","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"@clerk\",\n \"product\": \"chrome-extension\",\n \"versions\": [\n {\n \"version\": \">= 1.3.5, <= 2.9.14\",\n \"status\": \"affected\"\n },\n {\n \"version\": \">= 3.0.0, <= 3.1.14\",\n \"status\": \"affected\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"fastify","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"@clerk\",\n \"product\": \"fastify\",\n \"versions\": [\n {\n \"version\": \">= 1.0.42, <= 2.6.30\",\n \"status\": \"affected\"\n },\n {\n \"version\": \">= 3.0.0, <= 3.1.15\",\n \"status\": \"affected\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"express","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"@clerk\",\n \"product\": \"express\",\n \"versions\": [\n {\n \"version\": \">= 0.1.0, <= 1.7.78\",\n \"status\": \"affected\"\n },\n {\n \"version\": \">= 2.0.0, <= 2.1.5\",\n \"status\": \"affected\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"hono","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"@clerk\",\n \"product\": \"hono\",\n \"versions\": [\n {\n \"version\": \">= 0.0.2, <= 0.1.15\",\n \"status\": \"affected\"\n }\n ]\n }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","score":7.6,"severity":"HIGH"}],"references":["https://github.com/clerk/javascript/security/advisories/GHSA-w24r-5266-9c3c"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-42349","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-42349","identifiers":["CVE-2026-42349"]},"retained":false,"historicalAffected":[]}],"coverage":[]}