93 matches found
Server-side Request Forgery (SSRF)
Overview @clerk/backend is a Clerk Backend SDK - REST Client for Backend API & JWT verification utilities Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the clerkFrontendApiProxy function. An attacker can obtain secret keys by crafting a request path that...
GHSA-GJXX-92W9-8V8F Clerk: SSRF in the opt-in clerkFrontendApiProxy feature may leak secret keys to unintended host
Summary The clerkFrontendApiProxy function in @clerk/backend is vulnerable to Server-Side Request Forgery SSRF. An unauthenticated attacker can craft a request path that causes the proxy to send the application's Clerk-Secret-Key to an attacker-controlled server. Affected packages Only applicatio...
Clerk: SSRF in the opt-in clerkFrontendApiProxy feature may leak secret keys to unintended host
Summary The clerkFrontendApiProxy function in @clerk/backend is vulnerable to Server-Side Request Forgery SSRF. An unauthenticated attacker can craft a request path that causes the proxy to send the application's Clerk-Secret-Key to an attacker-controlled server. Affected packages Only applicatio...
PT-2026-28602
Summary The clerkFrontendApiProxy function in @clerk/backend is vulnerable to Server-Side Request Forgery SSRF. An unauthenticated attacker can craft a request path that causes the proxy to send the application's Clerk-Secret-Key to an attacker-controlled server. Affected packages Only applicatio...
MAL-2026-410 Malicious code in clerk-js (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 380b4e8d88a5d8a96ffe344566787326dbace52224d29a853cd4553fac40bd1c The package clerk-js was found to contain malicious code. Source: ghsa-malware 2433ecd39bbf328a21740fa34f33bb09d575e76f6f280b915c7ea15fbc55c2b3 Any...
Malicious Package
Overview clerk-js is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...
Malicious code in clerk-js (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 380b4e8d88a5d8a96ffe344566787326dbace52224d29a853cd4553fac40bd1c The package clerk-js was found to contain malicious code. Source: ghsa-malware 2433ecd39bbf328a21740fa34f33bb09d575e76f6f280b915c7ea15fbc55c2b3 Any...
EUVD-2026-3737
Malicious code in clerk-js npm...
CVE-2025-63700
An issue was discovered in clerk-js 5.88.0 allowing attackers to bypass the OAuth authentication flow by manipulating the request at the OTP verification stage. NOTE: this is disputed by the Supplier because there is no available information to reproduce the issue, and because an OAuth...
EUVD-2025-198353
An issue was discovered in Clerk-js 5.88.0 allowing attackers to bypass the OAuth authentication flow by manipulating the request at the OTP verification stage...
GHSA-3MM3-WFPV-Q85G Clerk-js vulnerable to bypass of OAuth authentication flow by manipulating request at OTP verification stage
An issue was discovered in Clerk-js 5.88.0 allowing attackers to bypass the OAuth authentication flow by manipulating the request at the OTP verification stage...
Clerk-js vulnerable to bypass of OAuth authentication flow by manipulating request at OTP verification stage
An issue was discovered in Clerk-js 5.88.0 allowing attackers to bypass the OAuth authentication flow by manipulating the request at the OTP verification stage...
CVE-2025-63700
Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
编号撤回
Official Clerk JavaScript SDKs is a Clerk open source official Javascript repository for Clerk authentication. A security vulnerability exists in the Official Clerk JavaScript SDKs version 5.88.0 that originates from an attacker being able to bypass the OAuth authentication process, potentially...
CVE-2025-63700
...
CVE-2025-63700
Clerk-js 5.88.0 contains a security issue where an attacker can bypass the OAuth authentication flow by manipulating the OTP verification request. The publicly documented evidence across sources (Red Hat CVE notes, EUVD, GHSA advisory, and OSV/GHSA mirrors) consistently reference the OTP verifica...
EUVD-2025-20865
Malicious code in bioql PyPI...