CVE-2025-63700

CVE-2025-63700 Bypass dell'autenticazione OAuth in Clerk-js 5.88.0 Prodotto interessato Fornitore : Clerk Inc. clerk.dev / clerk.com Prodotto : Clerk-js @clerk/clerk-js Versione interessata : 5.88.0 Impatto : Bypass dell'autenticazione OAuth CWE-290 : Bypass dell'autenticazione mediante spoofing...

@clerk/chrome-extension (>=3.0.0-canary.v20251211104600, <=3.1.14-canary.v20260417194309), @clerk/expo (>=3.0.0-canary.v20251211104600, <=3.2.1-canary.v20260417194309) potentially affected by CVE-2026-42349 via @clerk/clerk-js (>=6.0.0-canary.v20251211104600, <=6.7.4-canary.v20260417194309)

@clerk/clerk-js NPM version =6.0.0-canary.v20251211104600, =3.0.0-canary.v20251211104600, =3.0.0-canary.v20251211104600, =3.2.1-canary.v20260417194309 Source cves: CVE-2026-42349 Source advisory: OSV:GHSA-W24R-5266-9C3C...

@clerk/chrome-extension (>=3.0.0-canary.v20251211104600, <=3.1.14-canary.v20260417194309), @clerk/expo (>=3.0.0-canary.v20251211104600, <=3.2.1-canary.v20260417194309) potentially affected by CVE-2026-42349 via @clerk/clerk-js (>=6.0.0-canary.v20251211104600, <=6.7.4-canary.v20260417194309)

@clerk/clerk-js NPM version =6.0.0-canary.v20251211104600, =3.0.0-canary.v20251211104600, =3.0.0-canary.v20251211104600, =3.2.1-canary.v20260417194309 Source cves: CVE-2026-42349 Source advisory: SNYK:JS-CLERKCLERKJS-16347748...

@clerk/chrome-extension (>=1.3.5-canary.v097a1ce, <=2.0.9), @clerk/clerk-expo (>=2.2.11-canary.v097a1ce, <=2.4.5) +12 more potentially affected by CVE-2026-42349 via @clerk/clerk-js (>=5.22.0, <=5.120.0)

@clerk/clerk-js NPM version =5.22.0, =1.3.5-canary.v097a1ce, =2.2.11-canary.v097a1ce, =0.1.0, =0.24.2-dev-clerk, =0.24.2-dev-clerk, =0.24.3-dev-ensure-cloud-token-6, =0.0.5, =0.4.2, =0.19.1-dev-clerk, =0.19.0-dev-clerk, =0.19.0-dev-clerk, =0.8.0, =0.24.2-dev-clerk, =0.19.1-dev-clerk, =0.19.8-dev...

@clerk/chrome-extension (>=1.3.5-canary.v097a1ce, <=2.0.9), @clerk/clerk-expo (>=2.2.11-canary.v097a1ce, <=2.4.5) +12 more potentially affected by CVE-2026-42349 via @clerk/clerk-js (>=5.22.0, <=5.120.0)

@clerk/clerk-js NPM version =5.22.0, =1.3.5-canary.v097a1ce, =2.2.11-canary.v097a1ce, =0.1.0, =0.24.2-dev-clerk, =0.24.2-dev-clerk, =0.24.3-dev-ensure-cloud-token-6, =0.0.5, =0.4.2, =0.19.1-dev-clerk, =0.19.0-dev-clerk, =0.19.0-dev-clerk, =0.8.0, =0.24.2-dev-clerk, =0.19.1-dev-clerk, =0.19.8-dev...

PT-2026-36820

Name of the Vulnerable Software and Affected Versions @clerk/clerk-js versions prior to 5.125.10 @clerk/clerk-js versions prior to 6.7.5 @clerk/shared affected versions not specified @clerk/nextjs affected versions not specified @clerk/backend affected versions not specified Description...

MAL-2026-410 Malicious code in clerk-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 380b4e8d88a5d8a96ffe344566787326dbace52224d29a853cd4553fac40bd1c The package clerk-js was found to contain malicious code. Source: ghsa-malware 2433ecd39bbf328a21740fa34f33bb09d575e76f6f280b915c7ea15fbc55c2b3 Any...

Malicious code in clerk-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 380b4e8d88a5d8a96ffe344566787326dbace52224d29a853cd4553fac40bd1c The package clerk-js was found to contain malicious code. Source: ghsa-malware 2433ecd39bbf328a21740fa34f33bb09d575e76f6f280b915c7ea15fbc55c2b3 Any...

Malicious Package

Overview clerk-js is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

EUVD-2026-3737

Malicious code in clerk-js npm...

CVE-2025-63700

An issue was discovered in clerk-js 5.88.0 allowing attackers to bypass the OAuth authentication flow by manipulating the request at the OTP verification stage. NOTE: this is disputed by the Supplier because there is no available information to reproduce the issue, and because an OAuth...

@billyjacoby/clerk-react-native (>=1.0.0, <=1.0.4), @breakthroughsales/chrome-extension-remote-code-load-fix (>=1.0.16, <=1.0.22) +9 more potentially affected by CVE-2025-63700 via @clerk/clerk-js (>=5.0.0, <=5.85.0)

@clerk/clerk-js NPM version =5.0.0, =1.0.0, =1.0.16, =0.0.1-canary.v7ae5681, =1.0.0-alpha-v5.0, =1.0.0-alpha-v5.0, =0.1.0, =0.4.2, =0.0.0-snapshot-20240531221728, =1.0.17, =0.8.0, =0.0.0-1765923, =0.23.2 Source cves: CVE-2025-63700 Source advisory: OSV:GHSA-3MM3-WFPV-Q85G...

Clerk-js vulnerable to bypass of OAuth authentication flow by manipulating request at OTP verification stage

An issue was discovered in Clerk-js 5.88.0 allowing attackers to bypass the OAuth authentication flow by manipulating the request at the OTP verification stage...

GHSA-3MM3-WFPV-Q85G Clerk-js vulnerable to bypass of OAuth authentication flow by manipulating request at OTP verification stage

An issue was discovered in Clerk-js 5.88.0 allowing attackers to bypass the OAuth authentication flow by manipulating the request at the OTP verification stage...

CVE-2025-63700

Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

CVE-2025-63700

...