Refine your search

4 vulnerabilities found for by clerk

CVE-2026-41248 (GCVE-0-2026-41248)
Vulnerability from cvelistv5
Published
2026-04-24 21:04
Modified
2026-04-27 13:46
Severity ?
9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE
Summary
Clerk JavaScript is the official JavaScript repository for Clerk authentication. createRouteMatcher in @clerk/nextjs, @clerk/nuxt, and @clerk/astro can be bypassed by certain crafted requests, allowing them to skip middleware gating and reach downstream handlers. This vulnerability is fixed in @clerk/astro 1.5.7, 2.17.10, and 3.0.15; @clerk/nextjs 5.7.6, 6.39.2, and 7.2.1; @clerk/nuxt 1.13.28 and 2.2.2; and @clerk/shared 2.22.1, 3.47.4, anc 4.8.1
References
Impacted products
Vendor Product Version
clerk astro Version: >= 0.0.1, < 1.5.7
Version: >= 2.0.0-snapshot.v20241206174604, <= 2.17.9
Version: >= 3.0.0, < 3.0.15
 Create a notification for this product.
   clerk nextjs Version: >= 5.0.0, < 5.7.6
Version: >= 6.0.0-snapshot.vb87a27f, < 6.39.2
Version: >= 7.0.0, < 7.2.1
 Create a notification for this product.
   clerk nuxt Version: >= 1.1.0, < 1.13.28
Version: >= 2.0.0, < 2.2.2
 Create a notification for this product.
   clerk shared Version: >= 2.20.17, < 2.22.1
Version: >= 3.0.0-canary.v20250225091530, < 3.47.4
Version: >= 4.0.0, < 4.8.1
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-41248",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-27T13:46:14.373183Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-27T13:46:28.646Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "astro",
          "vendor": "clerk",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.0.1, \u003c 1.5.7"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.0.0-snapshot.v20241206174604, \u003c= 2.17.9"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.0.15"
            }
          ]
        },
        {
          "product": "nextjs",
          "vendor": "clerk",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 5.0.0, \u003c 5.7.6"
            },
            {
              "status": "affected",
              "version": "\u003e= 6.0.0-snapshot.vb87a27f, \u003c 6.39.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 7.0.0, \u003c 7.2.1"
            }
          ]
        },
        {
          "product": "nuxt",
          "vendor": "clerk",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.1.0, \u003c 1.13.28"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.0.0, \u003c 2.2.2"
            }
          ]
        },
        {
          "product": "shared",
          "vendor": "clerk",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.20.17, \u003c 2.22.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.0.0-canary.v20250225091530, \u003c 3.47.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.8.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Clerk JavaScript is the official JavaScript repository for Clerk authentication. createRouteMatcher in @clerk/nextjs, @clerk/nuxt, and @clerk/astro can be bypassed by certain crafted requests, allowing them to skip middleware gating and reach downstream handlers. This vulnerability is fixed in @clerk/astro 1.5.7, 2.17.10, and 3.0.15; @clerk/nextjs 5.7.6, 6.39.2, and 7.2.1; @clerk/nuxt 1.13.28 and 2.2.2; and @clerk/shared 2.22.1, 3.47.4, anc 4.8.1"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-436",
              "description": "CWE-436: Interpretation Conflict",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-24T21:04:35.810Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/clerk/javascript/security/advisories/GHSA-vqx2-fgx2-5wq9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/clerk/javascript/security/advisories/GHSA-vqx2-fgx2-5wq9"
        }
      ],
      "source": {
        "advisory": "GHSA-vqx2-fgx2-5wq9",
        "discovery": "UNKNOWN"
      },
      "title": "Official Clerk JavaScript SDKs:  Middleware-based route protection bypass"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-41248",
    "datePublished": "2026-04-24T21:04:35.810Z",
    "dateReserved": "2026-04-18T03:47:03.136Z",
    "dateUpdated": "2026-04-27T13:46:28.646Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-34076 (GCVE-0-2026-34076)
Vulnerability from cvelistv5
Published
2026-04-01 16:59
Modified
2026-04-01 18:00
Severity ?
7.4 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE
  • CWE-918 - Server-Side Request Forgery (SSRF)
Summary
Clerk JavaScript is the official JavaScript repository for Clerk authentication. In @clerk/hono from versions 0.1.0 to before 0.1.5, @clerk/express from versions 2.0.0 to before 2.0.7, @clerk/backend from versions 3.0.0 to before 3.2.3, and @clerk/fastify from versions 3.1.0 to before 3.1.5, the clerkFrontendApiProxy function in @clerk/backend is vulnerable to Server-Side Request Forgery (SSRF). An unauthenticated attacker can craft a request path that causes the proxy to send the application's Clerk-Secret-Key to an attacker-controlled server. This issue has been patched in @clerk/hono version 0.1.5, @clerk/express version 2.0.7, @clerk/backend version 3.2.3, and @clerk/fastify version 3.1.5.
References
Impacted products
Vendor Product Version
clerk javascript Version: @clerk/hono >= 0.1.0, < 0.1.5
Version: @clerk/express >= 2.0.0, < 2.0.7
Version: @clerk/backend >= 3.0.0, < 3.2.3
Version: @clerk/fastify >= 3.1.0, < 3.1.5
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-34076",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-01T18:00:15.522839Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-01T18:00:23.118Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "javascript",
          "vendor": "clerk",
          "versions": [
            {
              "status": "affected",
              "version": "@clerk/hono \u003e= 0.1.0, \u003c 0.1.5"
            },
            {
              "status": "affected",
              "version": "@clerk/express \u003e= 2.0.0, \u003c 2.0.7"
            },
            {
              "status": "affected",
              "version": "@clerk/backend \u003e= 3.0.0, \u003c 3.2.3"
            },
            {
              "status": "affected",
              "version": "@clerk/fastify \u003e= 3.1.0, \u003c 3.1.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Clerk JavaScript is the official JavaScript repository for Clerk authentication. In @clerk/hono from versions 0.1.0 to before 0.1.5, @clerk/express from versions 2.0.0 to before 2.0.7, @clerk/backend from versions 3.0.0 to before 3.2.3, and @clerk/fastify from versions 3.1.0 to before 3.1.5, the clerkFrontendApiProxy function in @clerk/backend is vulnerable to Server-Side Request Forgery (SSRF). An unauthenticated attacker can craft a request path that causes the proxy to send the application\u0027s Clerk-Secret-Key to an attacker-controlled server. This issue has been patched in @clerk/hono version 0.1.5, @clerk/express version 2.0.7, @clerk/backend version 3.2.3, and @clerk/fastify version 3.1.5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-01T16:59:21.828Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/clerk/javascript/security/advisories/GHSA-gjxx-92w9-8v8f",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/clerk/javascript/security/advisories/GHSA-gjxx-92w9-8v8f"
        }
      ],
      "source": {
        "advisory": "GHSA-gjxx-92w9-8v8f",
        "discovery": "UNKNOWN"
      },
      "title": "Clerk JavaScript: SSRF in the opt-in clerkFrontendApiProxy feature may leak secret keys to unintended host"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-34076",
    "datePublished": "2026-04-01T16:59:21.828Z",
    "dateReserved": "2026-03-25T16:21:40.868Z",
    "dateUpdated": "2026-04-01T18:00:23.118Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-53548 (GCVE-0-2025-53548)
Vulnerability from cvelistv5
Published
2025-07-09 17:12
Modified
2025-07-09 17:34
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE
  • CWE-345 - Insufficient Verification of Data Authenticity
Summary
Clerk helps developers build user management. Applications that use the verifyWebhook() helper to verify incoming Clerk webhooks are susceptible to accepting improperly signed webhook events. The issue was resolved in @clerk/backend 2.4.0.
References
Impacted products
Vendor Product Version
clerk javascript Version: < 2.4.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-53548",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-09T17:34:18.708328Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-09T17:34:36.765Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "javascript",
          "vendor": "clerk",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Clerk helps developers build user management. Applications that use the verifyWebhook() helper to verify incoming Clerk webhooks are susceptible to accepting improperly signed webhook events. The issue was resolved in @clerk/backend 2.4.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-345",
              "description": "CWE-345: Insufficient Verification of Data Authenticity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-09T17:12:10.483Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/clerk/javascript/security/advisories/GHSA-9mp4-77wg-rwx9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/clerk/javascript/security/advisories/GHSA-9mp4-77wg-rwx9"
        }
      ],
      "source": {
        "advisory": "GHSA-9mp4-77wg-rwx9",
        "discovery": "UNKNOWN"
      },
      "title": "@clerk/backend Performs Insufficient Verification of Data Authenticity"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-53548",
    "datePublished": "2025-07-09T17:12:10.483Z",
    "dateReserved": "2025-07-02T15:15:11.516Z",
    "dateUpdated": "2025-07-09T17:34:36.765Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-22206 (GCVE-0-2024-22206)
Vulnerability from cvelistv5
Published
2024-01-12 20:07
Modified
2024-11-14 15:42
Severity ?
9.0 (Critical) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CWE
  • CWE-284 - Improper Access Control
  • CWE-287 - Improper Authentication
  • CWE-639 - Authorization Bypass Through User-Controlled Key
Summary
Clerk helps developers build user management. Unauthorized access or privilege escalation due to a logic flaw in auth() in the App Router or getAuth() in the Pages Router. This vulnerability was patched in version 4.29.3.
References
Impacted products
Vendor Product Version
clerk javascript Version: >= 4.7.0, < 4.29.3
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T22:35:34.930Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/clerk/javascript/security/advisories/GHSA-q6w5-jg5q-47vg",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/clerk/javascript/security/advisories/GHSA-q6w5-jg5q-47vg"
          },
          {
            "name": "https://clerk.com/changelog/2024-01-12",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://clerk.com/changelog/2024-01-12"
          },
          {
            "name": "https://github.com/clerk/javascript/releases/tag/%40clerk%2Fnextjs%404.29.3",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/clerk/javascript/releases/tag/%40clerk%2Fnextjs%404.29.3"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-22206",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-14T15:42:26.578504Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-14T15:42:39.402Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "javascript",
          "vendor": "clerk",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.7.0, \u003c 4.29.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Clerk helps developers build user management. Unauthorized access or privilege escalation due to a logic flaw in auth() in the App Router or getAuth() in the Pages Router. This vulnerability was patched in version 4.29.3.\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284: Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287: Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-01-12T20:07:40.402Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/clerk/javascript/security/advisories/GHSA-q6w5-jg5q-47vg",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/clerk/javascript/security/advisories/GHSA-q6w5-jg5q-47vg"
        },
        {
          "name": "https://clerk.com/changelog/2024-01-12",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://clerk.com/changelog/2024-01-12"
        },
        {
          "name": "https://github.com/clerk/javascript/releases/tag/%40clerk%2Fnextjs%404.29.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/clerk/javascript/releases/tag/%40clerk%2Fnextjs%404.29.3"
        }
      ],
      "source": {
        "advisory": "GHSA-q6w5-jg5q-47vg",
        "discovery": "UNKNOWN"
      },
      "title": "@clerk/nextjs auth() and getAuth() methods vulnerable to insecure direct object reference (IDOR)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-22206",
    "datePublished": "2024-01-12T20:07:40.402Z",
    "dateReserved": "2024-01-08T04:59:27.373Z",
    "dateUpdated": "2024-11-14T15:42:39.402Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}