Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
2 vulnerabilities found for clerk\/tanstack-react-start by clerk
CVE-2026-42349 (GCVE-0-2026-42349)
Vulnerability from nvd – Published: 2026-05-11 16:08 – Updated: 2026-05-14 18:19
VLAI
Title
Clerk: Authorization bypass when combining organization, billing, or reverification checks
Summary
Clerk JavaScript is the official JavaScript repository for Clerk authentication. has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result should be false, allowing a gated action to proceed for a user who does not satisfy the full set of requested conditions. This call shape can be bypassed if certain conditions are met: a has() or auth.protect() call that combines a reverification check with any of role, permission, feature, or plan, or that combines a billing check (feature or plan) with a role or permission check. This vulnerability is fixed in @clerk/clerk-js 5.125.10 and 6.7.5.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/clerk/javascript/security/advi… | x_refsource_CONFIRM |
Impacted products
17 products
| Vendor | Product | Version | |
|---|---|---|---|
| clerk | javascript |
Affected:
>= 5.22.0, < 5.125.10
Affected: >= 6.0.0, < 6.7.5 |
|
| @clerk | shared |
Affected:
>= 3.0.0, <= 3.47.4
Affected: >= 4.0.0, <= 4.8.2 |
|
| @clerk | backend |
Affected:
>= 2.0.0, <= 2.33.2
Affected: >= 3.0.0, <= 3.2.13 |
|
| @clerk | nextjs |
Affected:
>= 6.0.0, <= 6.39.2
Affected: >= 7.0.0, <= 7.2.3 |
|
| @clerk | clerk-react |
Affected:
>= 5.9.0, <= 5.61.5
|
|
| @clerk | react |
Affected:
>= 6.0.0, <= 6.4.2
|
|
| @clerk | vue |
Affected:
>= 1.0.0, <= 1.17.20
Affected: >= 2.0.0, <= 2.0.15 |
|
| @clerk | astro |
Affected:
>= 2.0.0, <= 2.17.10
Affected: >= 3.0.0, <= 3.0.17 |
|
| @clerk | nuxt |
Affected:
>= 1.0.0, <= 1.13.28
Affected: >= 2.0.0, <= 2.2.4 |
|
| @clerk | clerk-expo |
Affected:
>= 2.2.11, <= 2.19.35
|
|
| @clerk | expo |
Affected:
>= 3.0.0, <= 3.2.1
|
|
| @clerk | react-router |
Affected:
>= 0.0.1, <= 2.4.12
Affected: >= 3.0.0, <= 3.1.3 |
|
| @clerk | tanstack-react-start |
Affected:
>= 0.0.1, <= 0.29.10
Affected: >= 1.0.0, <= 1.1.3 |
|
| @clerk | chrome-extension |
Affected:
>= 1.3.5, <= 2.9.14
Affected: >= 3.0.0, <= 3.1.14 |
|
| @clerk | fastify |
Affected:
>= 1.0.42, <= 2.6.30
Affected: >= 3.0.0, <= 3.1.15 |
|
| @clerk | express |
Affected:
>= 0.1.0, <= 1.7.78
Affected: >= 2.0.0, <= 2.1.5 |
|
| @clerk | hono |
Affected:
>= 0.0.2, <= 0.1.15
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-42349",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-14T18:18:41.752602Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-14T18:19:38.735Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/clerk/javascript/security/advisories/GHSA-w24r-5266-9c3c"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "javascript",
"vendor": "clerk",
"versions": [
{
"status": "affected",
"version": "\u003e= 5.22.0, \u003c 5.125.10"
},
{
"status": "affected",
"version": "\u003e= 6.0.0, \u003c 6.7.5"
}
]
},
{
"product": "shared",
"vendor": "@clerk",
"versions": [
{
"status": "affected",
"version": "\u003e= 3.0.0, \u003c= 3.47.4"
},
{
"status": "affected",
"version": "\u003e= 4.0.0, \u003c= 4.8.2"
}
]
},
{
"product": "backend",
"vendor": "@clerk",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.0.0, \u003c= 2.33.2"
},
{
"status": "affected",
"version": "\u003e= 3.0.0, \u003c= 3.2.13"
}
]
},
{
"product": "nextjs",
"vendor": "@clerk",
"versions": [
{
"status": "affected",
"version": "\u003e= 6.0.0, \u003c= 6.39.2"
},
{
"status": "affected",
"version": "\u003e= 7.0.0, \u003c= 7.2.3"
}
]
},
{
"product": "clerk-react",
"vendor": "@clerk",
"versions": [
{
"status": "affected",
"version": "\u003e= 5.9.0, \u003c= 5.61.5"
}
]
},
{
"product": "react",
"vendor": "@clerk",
"versions": [
{
"status": "affected",
"version": "\u003e= 6.0.0, \u003c= 6.4.2"
}
]
},
{
"product": "vue",
"vendor": "@clerk",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.0.0, \u003c= 1.17.20"
},
{
"status": "affected",
"version": "\u003e= 2.0.0, \u003c= 2.0.15"
}
]
},
{
"product": "astro",
"vendor": "@clerk",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.0.0, \u003c= 2.17.10"
},
{
"status": "affected",
"version": "\u003e= 3.0.0, \u003c= 3.0.17"
}
]
},
{
"product": "nuxt",
"vendor": "@clerk",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.0.0, \u003c= 1.13.28"
},
{
"status": "affected",
"version": "\u003e= 2.0.0, \u003c= 2.2.4"
}
]
},
{
"product": "clerk-expo",
"vendor": "@clerk",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.2.11, \u003c= 2.19.35"
}
]
},
{
"product": "expo",
"vendor": "@clerk",
"versions": [
{
"status": "affected",
"version": "\u003e= 3.0.0, \u003c= 3.2.1"
}
]
},
{
"product": "react-router",
"vendor": "@clerk",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.0.1, \u003c= 2.4.12"
},
{
"status": "affected",
"version": "\u003e= 3.0.0, \u003c= 3.1.3"
}
]
},
{
"product": "tanstack-react-start",
"vendor": "@clerk",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.0.1, \u003c= 0.29.10"
},
{
"status": "affected",
"version": "\u003e= 1.0.0, \u003c= 1.1.3"
}
]
},
{
"product": "chrome-extension",
"vendor": "@clerk",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.3.5, \u003c= 2.9.14"
},
{
"status": "affected",
"version": "\u003e= 3.0.0, \u003c= 3.1.14"
}
]
},
{
"product": "fastify",
"vendor": "@clerk",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.0.42, \u003c= 2.6.30"
},
{
"status": "affected",
"version": "\u003e= 3.0.0, \u003c= 3.1.15"
}
]
},
{
"product": "express",
"vendor": "@clerk",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.1.0, \u003c= 1.7.78"
},
{
"status": "affected",
"version": "\u003e= 2.0.0, \u003c= 2.1.5"
}
]
},
{
"product": "hono",
"vendor": "@clerk",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.0.2, \u003c= 0.1.15"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Clerk JavaScript is the official JavaScript repository for Clerk authentication. has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result should be false, allowing a gated action to proceed for a user who does not satisfy the full set of requested conditions. This call shape can be bypassed if certain conditions are met: a has() or auth.protect() call that combines a reverification check with any of role, permission, feature, or plan, or that combines a billing check (feature or plan) with a role or permission check. This vulnerability is fixed in @clerk/clerk-js 5.125.10 and 6.7.5."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-754",
"description": "CWE-754: Improper Check for Unusual or Exceptional Conditions",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T16:08:27.869Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/clerk/javascript/security/advisories/GHSA-w24r-5266-9c3c",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/clerk/javascript/security/advisories/GHSA-w24r-5266-9c3c"
}
],
"source": {
"advisory": "GHSA-w24r-5266-9c3c",
"discovery": "UNKNOWN"
},
"title": "Clerk: Authorization bypass when combining organization, billing, or reverification checks"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-42349",
"datePublished": "2026-05-11T16:08:27.869Z",
"dateReserved": "2026-04-26T13:26:14.515Z",
"dateUpdated": "2026-05-14T18:19:38.735Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-42349 (GCVE-0-2026-42349)
Vulnerability from cvelistv5 – Published: 2026-05-11 16:08 – Updated: 2026-05-14 18:19
VLAI
Title
Clerk: Authorization bypass when combining organization, billing, or reverification checks
Summary
Clerk JavaScript is the official JavaScript repository for Clerk authentication. has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result should be false, allowing a gated action to proceed for a user who does not satisfy the full set of requested conditions. This call shape can be bypassed if certain conditions are met: a has() or auth.protect() call that combines a reverification check with any of role, permission, feature, or plan, or that combines a billing check (feature or plan) with a role or permission check. This vulnerability is fixed in @clerk/clerk-js 5.125.10 and 6.7.5.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/clerk/javascript/security/advi… | x_refsource_CONFIRM |
Impacted products
17 products
| Vendor | Product | Version | |
|---|---|---|---|
| clerk | javascript |
Affected:
>= 5.22.0, < 5.125.10
Affected: >= 6.0.0, < 6.7.5 |
|
| @clerk | shared |
Affected:
>= 3.0.0, <= 3.47.4
Affected: >= 4.0.0, <= 4.8.2 |
|
| @clerk | backend |
Affected:
>= 2.0.0, <= 2.33.2
Affected: >= 3.0.0, <= 3.2.13 |
|
| @clerk | nextjs |
Affected:
>= 6.0.0, <= 6.39.2
Affected: >= 7.0.0, <= 7.2.3 |
|
| @clerk | clerk-react |
Affected:
>= 5.9.0, <= 5.61.5
|
|
| @clerk | react |
Affected:
>= 6.0.0, <= 6.4.2
|
|
| @clerk | vue |
Affected:
>= 1.0.0, <= 1.17.20
Affected: >= 2.0.0, <= 2.0.15 |
|
| @clerk | astro |
Affected:
>= 2.0.0, <= 2.17.10
Affected: >= 3.0.0, <= 3.0.17 |
|
| @clerk | nuxt |
Affected:
>= 1.0.0, <= 1.13.28
Affected: >= 2.0.0, <= 2.2.4 |
|
| @clerk | clerk-expo |
Affected:
>= 2.2.11, <= 2.19.35
|
|
| @clerk | expo |
Affected:
>= 3.0.0, <= 3.2.1
|
|
| @clerk | react-router |
Affected:
>= 0.0.1, <= 2.4.12
Affected: >= 3.0.0, <= 3.1.3 |
|
| @clerk | tanstack-react-start |
Affected:
>= 0.0.1, <= 0.29.10
Affected: >= 1.0.0, <= 1.1.3 |
|
| @clerk | chrome-extension |
Affected:
>= 1.3.5, <= 2.9.14
Affected: >= 3.0.0, <= 3.1.14 |
|
| @clerk | fastify |
Affected:
>= 1.0.42, <= 2.6.30
Affected: >= 3.0.0, <= 3.1.15 |
|
| @clerk | express |
Affected:
>= 0.1.0, <= 1.7.78
Affected: >= 2.0.0, <= 2.1.5 |
|
| @clerk | hono |
Affected:
>= 0.0.2, <= 0.1.15
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-42349",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-14T18:18:41.752602Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-14T18:19:38.735Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/clerk/javascript/security/advisories/GHSA-w24r-5266-9c3c"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "javascript",
"vendor": "clerk",
"versions": [
{
"status": "affected",
"version": "\u003e= 5.22.0, \u003c 5.125.10"
},
{
"status": "affected",
"version": "\u003e= 6.0.0, \u003c 6.7.5"
}
]
},
{
"product": "shared",
"vendor": "@clerk",
"versions": [
{
"status": "affected",
"version": "\u003e= 3.0.0, \u003c= 3.47.4"
},
{
"status": "affected",
"version": "\u003e= 4.0.0, \u003c= 4.8.2"
}
]
},
{
"product": "backend",
"vendor": "@clerk",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.0.0, \u003c= 2.33.2"
},
{
"status": "affected",
"version": "\u003e= 3.0.0, \u003c= 3.2.13"
}
]
},
{
"product": "nextjs",
"vendor": "@clerk",
"versions": [
{
"status": "affected",
"version": "\u003e= 6.0.0, \u003c= 6.39.2"
},
{
"status": "affected",
"version": "\u003e= 7.0.0, \u003c= 7.2.3"
}
]
},
{
"product": "clerk-react",
"vendor": "@clerk",
"versions": [
{
"status": "affected",
"version": "\u003e= 5.9.0, \u003c= 5.61.5"
}
]
},
{
"product": "react",
"vendor": "@clerk",
"versions": [
{
"status": "affected",
"version": "\u003e= 6.0.0, \u003c= 6.4.2"
}
]
},
{
"product": "vue",
"vendor": "@clerk",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.0.0, \u003c= 1.17.20"
},
{
"status": "affected",
"version": "\u003e= 2.0.0, \u003c= 2.0.15"
}
]
},
{
"product": "astro",
"vendor": "@clerk",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.0.0, \u003c= 2.17.10"
},
{
"status": "affected",
"version": "\u003e= 3.0.0, \u003c= 3.0.17"
}
]
},
{
"product": "nuxt",
"vendor": "@clerk",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.0.0, \u003c= 1.13.28"
},
{
"status": "affected",
"version": "\u003e= 2.0.0, \u003c= 2.2.4"
}
]
},
{
"product": "clerk-expo",
"vendor": "@clerk",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.2.11, \u003c= 2.19.35"
}
]
},
{
"product": "expo",
"vendor": "@clerk",
"versions": [
{
"status": "affected",
"version": "\u003e= 3.0.0, \u003c= 3.2.1"
}
]
},
{
"product": "react-router",
"vendor": "@clerk",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.0.1, \u003c= 2.4.12"
},
{
"status": "affected",
"version": "\u003e= 3.0.0, \u003c= 3.1.3"
}
]
},
{
"product": "tanstack-react-start",
"vendor": "@clerk",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.0.1, \u003c= 0.29.10"
},
{
"status": "affected",
"version": "\u003e= 1.0.0, \u003c= 1.1.3"
}
]
},
{
"product": "chrome-extension",
"vendor": "@clerk",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.3.5, \u003c= 2.9.14"
},
{
"status": "affected",
"version": "\u003e= 3.0.0, \u003c= 3.1.14"
}
]
},
{
"product": "fastify",
"vendor": "@clerk",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.0.42, \u003c= 2.6.30"
},
{
"status": "affected",
"version": "\u003e= 3.0.0, \u003c= 3.1.15"
}
]
},
{
"product": "express",
"vendor": "@clerk",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.1.0, \u003c= 1.7.78"
},
{
"status": "affected",
"version": "\u003e= 2.0.0, \u003c= 2.1.5"
}
]
},
{
"product": "hono",
"vendor": "@clerk",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.0.2, \u003c= 0.1.15"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Clerk JavaScript is the official JavaScript repository for Clerk authentication. has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result should be false, allowing a gated action to proceed for a user who does not satisfy the full set of requested conditions. This call shape can be bypassed if certain conditions are met: a has() or auth.protect() call that combines a reverification check with any of role, permission, feature, or plan, or that combines a billing check (feature or plan) with a role or permission check. This vulnerability is fixed in @clerk/clerk-js 5.125.10 and 6.7.5."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-754",
"description": "CWE-754: Improper Check for Unusual or Exceptional Conditions",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T16:08:27.869Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/clerk/javascript/security/advisories/GHSA-w24r-5266-9c3c",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/clerk/javascript/security/advisories/GHSA-w24r-5266-9c3c"
}
],
"source": {
"advisory": "GHSA-w24r-5266-9c3c",
"discovery": "UNKNOWN"
},
"title": "Clerk: Authorization bypass when combining organization, billing, or reverification checks"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-42349",
"datePublished": "2026-05-11T16:08:27.869Z",
"dateReserved": "2026-04-26T13:26:14.515Z",
"dateUpdated": "2026-05-14T18:19:38.735Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}