136 matches found
CVE-2025-63700
CVE-2025-63700 OAuth Authentication Bypass in Clerk-js 5.88.0 Affected Product Vendor : Clerk Inc. clerk.dev / clerk.com Product : Clerk-js @clerk/clerk-js Affected Version : 5.88.0 Impact : OAuth Authentication Bypass CWE-290 : Authentication Bypass by Spoofing Bug Author Hasnat Ibrahim Nishat -...
Malicious Package
Overview @0xlr/clerk-auth is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
MAL-2026-11069 Malicious code in clerk-next-fix-auth-protection (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4fd8aaf2fc6ca964eed6950b6868486125905bacabe6b8bb1cbd581bb6a59f4c [email protected] is a typosquat of Clerk/Next.js auth tooling that ships no functional code declared main index.js is absent from...
Malicious code in @mastra/auth-clerk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d80aa3e2beb7b80c5c0ab6155ebf33290b48d7e23a97f7dc5e2f7bc288d5e84f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-5385 Malicious code in @0xlr/clerk-auth (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2ff421a5ccb412fd8455e89a1b9875b427ed34af12fa4b188ed4418cd8f52a74 On npm install, postinstall.js enumerates the entire process environment Object.keysprocess.env.sort.forEach along with hostname, username, home...
CVE-2026-42349
Clerk JavaScript is the official JavaScript repository for Clerk authentication. has, auth.protect, and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result should be...
CVE-2026-42349
Clerk JavaScript is the official JavaScript repository for Clerk authentication. has, auth.protect, and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result should be...
CVE-2026-42349 Clerk: Authorization bypass when combining organization, billing, or reverification checks
Clerk JavaScript is the official JavaScript repository for Clerk authentication. has, auth.protect, and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result should be...
CVE-2026-42349 Clerk: Authorization bypass when combining organization, billing, or reverification checks
Clerk JavaScript is the official JavaScript repository for Clerk authentication. has, auth.protect, and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result should be...
CVE-2026-42349
Clerk JavaScript is the official JavaScript repository for Clerk authentication. has, auth.protect, and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result should be...
CVE-2026-42349
CVE-2026-42349 - Clerk authorization bypass : Cler k JS ecosystem components (@clerk/shared, @clerk/nextjs, @clerk/backend, and related SDKs) can incorrectly return true for combined authorization checks in has()/auth.protect(), allowing a gated action to proceed when a user does not satisfy all ...
CVE-2026-42349 Clerk: Authorization bypass when combining organization, billing, or reverification checks
Clerk JavaScript is the official JavaScript repository for Clerk authentication. has, auth.protect, and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result should be...
CVE-2026-42349: Improper Check for Unusual or Exceptional Conditions
Clerk JavaScript is the official JavaScript repository for Clerk authentication. has, auth.protect, and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result should be...
Official Clerk JavaScript SDKs ไปฃ็ ้ฎ้ขๆผๆด
The Official Clerk JavaScript SDKs are an open-source repository for Clerk authentication purposes. These SDKs have code vulnerabilities that can lead to false positives during authorization checks. This occurs when functions like has and auth.protect, along with related authorization predicates,...
@clerk/chrome-extension (>=3.0.0-canary.v20251211104600, <=3.1.14-canary.v20260417194309), @clerk/expo (>=3.0.0-canary.v20251211104600, <=3.2.1-canary.v20260417194309) potentially affected by CVE-2026-42349 via @clerk/clerk-js (>=6.0.0-canary.v20251211104600, <=6.7.4-canary.v20260417194309)
@clerk/clerk-js NPM version =6.0.0-canary.v20251211104600, =3.0.0-canary.v20251211104600, =3.0.0-canary.v20251211104600, =3.2.1-canary.v20260417194309 Source cves: CVE-2026-42349 Source advisory: SNYK:JS-CLERKCLERKJS-16347748...
@aipmorg/chat (1.5.3), @appconda/react (1.0.242) +54 more potentially affected by CVE-2026-42349 via @clerk/clerk-react (>=5.9.0, <=5.61.3)
@clerk/clerk-react NPM version =5.9.0, =1.34.0, =1.0.0, =1.3.5-canary.v097a1ce, =2.2.11-canary.v097a1ce, =0.19.4-canary.v02b9ae0a47871adccfefb247878691b72e25e929, =1.2.0-staging.0, =0.0.1-canary.v20241209160532, =4.2.26-canary.v097a1ce, =0.12.0-canary.v20250325162153, =0.4.2-canary.v097a1ce,...
@clerk/agent-toolkit (>=0.2.9-canary.v20251211104600, <=0.3.16-snapshot.v20260416221307), @clerk/astro (>=3.0.0-canary.v20251211104600, <=3.0.16-snapshot.v20260416221307) +43 more potentially affected by CVE-2026-42349 via @clerk/shared (>=4.0.0, <=4.8.2-snapshot.v20260416221307)
@clerk/shared NPM version =4.0.0, =0.2.9-canary.v20251211104600, =3.0.0-canary.v20251211104600, =3.0.0-canary.v20251211104600, =3.0.0-canary.v20251211104600, =3.0.0-snapshot.v20251216175437, =3.0.0-canary.v20251211104600, =0.4.26-snapshot.v20260226165729, =2.0.0-canary.v20251211104600,...
@clerk/chrome-extension (>=3.0.0-canary.v20251211104600, <=3.1.13-snapshot.v20260416221307), @clerk/expo (>=3.0.0-canary.v20251211104600, <=3.2.0-snapshot.v20260416221307) +7 more potentially affected by CVE-2026-42349 via @clerk/react (>=6.0.0-canary.v20251211104600, <=6.4.2-snapshot.v20260416221307)
@clerk/react NPM version =6.0.0-canary.v20251211104600, =3.0.0-canary.v20251211104600, =3.0.0-canary.v20251211104600, =7.0.0-canary.v20251211104600, =3.0.0-canary.v20251211104600, =1.0.0-canary.v20251211104600, =2.0.0-dev-cli-10, =2.0.0-dev-cli-10, =0.20.1-dev-push, =0.20.3-dev-push,...
@clerk/agent-toolkit (>=0.2.9-canary.v20251211104600, <=0.3.16-snapshot.v20260416221307), @clerk/astro (>=3.0.0-canary.v20251211104600, <=3.0.17-canary.v20260417194309) +10 more potentially affected by CVE-2026-42349 via @clerk/backend (>=3.0.0, <=3.2.13-canary.v20260417194309)
@clerk/backend NPM version =3.0.0, =0.2.9-canary.v20251211104600, =3.0.0-canary.v20251211104600, =2.0.0-canary.v20251211104600, =2.6.9-canary.v20251211104600, =0.0.1, =7.0.0-canary.v20251211104600, =2.0.0-canary.v20251211104600, =3.0.0-canary.v20251211104600, =1.0.0-canary.v20251211104600,...
@clerk/agent-toolkit (>=0.2.9-canary.v20251211104600, <=0.3.16-snapshot.v20260416221307), @clerk/astro (>=3.0.0-canary.v20251211104600, <=3.0.16-snapshot.v20260416221307) +43 more potentially affected by CVE-2026-42349 via @clerk/shared (>=4.0.0, <=4.8.2-snapshot.v20260416221307)
@clerk/shared NPM version =4.0.0, =0.2.9-canary.v20251211104600, =3.0.0-canary.v20251211104600, =3.0.0-canary.v20251211104600, =3.0.0-canary.v20251211104600, =3.0.0-snapshot.v20251216175437, =3.0.0-canary.v20251211104600, =0.4.26-snapshot.v20260226165729, =2.0.0-canary.v20251211104600,...