124 matches found
CVE-2025-63700
Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
CVE-2025-63700
...
编号撤回
Official Clerk JavaScript SDKs is a Clerk open source official Javascript repository for Clerk authentication. A security vulnerability exists in the Official Clerk JavaScript SDKs version 5.88.0 that originates from an attacker being able to bypass the OAuth authentication process, potentially...
CVE-2025-63700
Clerk-js 5.88.0 contains a security issue where an attacker can bypass the OAuth authentication flow by manipulating the OTP verification request. The publicly documented evidence across sources (Red Hat CVE notes, EUVD, GHSA advisory, and OSV/GHSA mirrors) consistently reference the OTP verifica...
EUVD-2025-20865
Malicious code in bioql PyPI...
EUVD-2022-43243
Malicious code in bioql PyPI...
Malicious code in @malware-test-helps-modal-clerk-menes/test-mlw3-helps-modal-clerk-menes (npm)
The package @malware-test-helps-modal-clerk-menes/test-mlw3-helps-modal-clerk-menes was found to contain malicious code...
MAL-2025-8708 Malicious code in @malware-test-helps-modal-clerk-menes/test-mlw3-helps-modal-clerk-menes (npm)
The package @malware-test-helps-modal-clerk-menes/test-mlw3-helps-modal-clerk-menes was found to contain malicious code...
CVE-2025-53548
Clerk helps developers build user management. Applications that use the verifyWebhook helper to verify incoming Clerk webhooks are susceptible to accepting improperly signed webhook events. The issue was resolved in @clerk/backend 2.4.0...
@unhook/cli (>=0.9.3, <=0.13.1) potentially affected by CVE-2025-53548 via @clerk/express (>=1.6.0, <=1.7.0)
@clerk/express NPM version =1.6.0, =0.9.3, =0.13.1 Source cves: CVE-2025-53548 Source advisory: OSV:GHSA-9MP4-77WG-RWX9...
@bentwnghk/chat (>=1.91.2, <=1.91.6), @lobehub/chat (>=1.49.5, <=1.49.12) +1 more potentially affected by CVE-2025-53548 via @clerk/nextjs (>=6.3.1, <=6.17.0)
@clerk/nextjs NPM version =6.3.1, =1.91.2, =1.49.5, =0.17.0-alpha.9, =0.17.3-centauri.0 Source cves: CVE-2025-53548 Source advisory: OSV:GHSA-9MP4-77WG-RWX9...
@unhook/cli (>=0.9.3, <=0.13.1) potentially affected by CVE-2025-53548 via @clerk/backend (>=2.0.0, <=2.1.0)
@clerk/backend NPM version =2.0.0, =0.9.3, =0.13.1 Source cves: CVE-2025-53548 Source advisory: OSV:GHSA-9MP4-77WG-RWX9...
CVE-2025-53548
CVE-2025-53548 concerns Clerk’s verifyWebhook() validation. Across connected documents, the issue is that the verifyWebhook() helper may accept improperly signed webhook events, enabling signature forgery. The vulnerability is mitigated by upgrading to @clerk/backend 2.4.0, which properly parses ...
CVE-2025-53548 @clerk/backend Performs Insufficient Verification of Data Authenticity
Clerk helps developers build user management. Applications that use the verifyWebhook helper to verify incoming Clerk webhooks are susceptible to accepting improperly signed webhook events. The issue was resolved in @clerk/backend 2.4.0...
CVE-2025-53548 @clerk/backend Performs Insufficient Verification of Data Authenticity
Clerk helps developers build user management. Applications that use the verifyWebhook helper to verify incoming Clerk webhooks are susceptible to accepting improperly signed webhook events. The issue was resolved in @clerk/backend 2.4.0...
CVE-2025-53548 @clerk/backend Performs Insufficient Verification of Data Authenticity
Clerk helps developers build user management. Applications that use the verifyWebhook helper to verify incoming Clerk webhooks are susceptible to accepting improperly signed webhook events. The issue was resolved in @clerk/backend 2.4.0...
PT-2025-28943 · Clerk · @Clerk/Backend
Name of the Vulnerable Software and Affected Versions: @clerk/backend versions prior to 2.4.0 Description: Applications utilizing the verifyWebhook helper to verify incoming Clerk webhooks are susceptible to accepting improperly signed webhook events. Recommendations: Upgrade to @clerk/backend...
Official Clerk JavaScript SDKs 数据伪造问题漏洞
Official Clerk JavaScript SDKs is a Clerk open source official Javascript repository for Clerk authentication. A data forgery vulnerability exists in the Official Clerk JavaScript SDKs, which stems from insufficient verifyWebhook validation and may result in the acceptance of unsigned webhook...
CVE-2022-3907
The Clerk WordPress plugin before 4.0.0 is affected by time-based attacks in the validation function for all API requests due to the usage of comparison operators to verify API keys against the ones stored in the site options...