Dashboard / CVE-2026-42349

CVE-2026-42349

HIGH
MEDIUM Priority: 0.02 BB Relevance: 65/100
Published: 2026-05-11 Modified: 2026-10-26 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
S: X
AT: Present
VC: High
VI: High
VA: None

Description

Clerk JavaScript is the official JavaScript repository for Clerk authentication. has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result should be false, allowing a gated action to proceed for a user who does not satisfy the full set of requested conditions. This call shape can be bypassed if certain conditions are met: a has() or auth.protect() call that combines a reverification check with any of role, permission, feature, or plan, or that combines a billing check (feature or plan) with a role or permission check. This vulnerability is fixed in @clerk/clerk-js 5.125.10 and 6.7.5.

Weakness Classification (2)

Affected Software (29)

VendorProductVersion
clerk clerk\/astro 2.0.0 – 2.17.11
clerk clerk\/astro 3.0.0 – 3.0.18
clerk clerk\/backend 2.0.0 – 2.33.3
clerk clerk\/backend 3.0.0 – 3.2.14
clerk clerk\/chrome-extension 1.3.5 – 2.9.15
clerk clerk\/chrome-extension 3.0.0 – 3.1.15
clerk clerk\/clerk-expo 2.2.11 – 2.19.36
clerk clerk\/clerk-js 5.22.0 – 5.125.10
clerk clerk\/clerk-js 6.0.0 – 6.7.5
clerk clerk\/clerk-react 5.9.0 – 5.61.6
clerk clerk\/expo 3.0.0 – 3.2.2
clerk clerk\/express 0.1.0 – 1.7.79
clerk clerk\/express 2.0.0 – 2.1.6
clerk clerk\/fastify 1.0.42 – 2.6.31
clerk clerk\/fastify 3.0.0 – 3.1.16
clerk clerk\/hono 0.0.2 – 0.1.16
clerk clerk\/nextjs 6.0.0 – 6.39.3
clerk clerk\/nextjs 7.0.0 – 7.2.4
clerk clerk\/nuxt 1.0.0 – 1.13.29
clerk clerk\/nuxt 2.0.0 – 2.2.5
clerk clerk\/react 6.0.0 – 6.4.3
clerk clerk\/react-router 0.0.1 – 2.4.13
clerk clerk\/react-router 3.0.0 – 3.1.4
clerk clerk\/shared 3.0.0 – 3.47.5
clerk clerk\/shared 4.0.0 – 4.8.3
clerk clerk\/tanstack-react-start 0.0.1 – 0.29.11
clerk clerk\/tanstack-react-start 1.0.0 – 1.1.4
clerk clerk\/vue 1.0.0 – 1.17.21
clerk clerk\/vue 2.0.0 – 2.0.16

References & Advisories (1)

Bug Bounty Relevance

65 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

7.6 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.25%
Raw Score 0.002460
Percentile 15.8%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00246
2026-10-28
0.00246

Intelligence Sources

nvd ref →

External Links