CVE-2026-42349: Clerk: Authorization bypass when combining organization, billing, or reverification checks

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-11 · updated 2026-10-26
Weakness: CWE-754

Description

Clerk JavaScript is the official JavaScript repository for Clerk authentication. has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result should be false, allowing a gated action to proceed for a user who does not satisfy the full set of requested conditions. This call shape can be bypassed if certain conditions are met: a has() or auth.protect() call that combines a reverification check with any of role, permission, feature, or plan, or that combines a billing check (feature or plan) with a role or permission check. This vulnerability is fixed in @clerk/clerk-js 5.125.10 and 6.7.5.

Affected products

@clerk Clerk/Astro: from 2.0.0 before 2.17.11; from 3.0.0 before 3.0.18 — fixed in 2.17.11, 3.0.18
@clerk Clerk/Backend: from 2.0.0 before 2.33.3; from 3.0.0 before 3.2.14 — fixed in 2.33.3, 3.2.14
@clerk Clerk/Chrome-Extension: from 1.3.5 before 2.9.15; from 3.0.0 before 3.1.15 — fixed in 2.9.15, 3.1.15
@clerk Clerk/Clerk-Expo: from 2.2.11 before 2.19.36 — fixed in 2.19.36
@clerk Clerk/Clerk-Js: from 5.22.0 before 5.125.10; from 6.0.0 before 6.7.5 — fixed in 5.125.10, 6.7.5
@clerk Clerk/Clerk-React: from 5.9.0 before 5.61.6 — fixed in 5.61.6
@clerk Clerk/Expo: from 3.0.0 before 3.2.2 — fixed in 3.2.2
@clerk Clerk/Express: from 0.1.0 before 1.7.79; from 2.0.0 before 2.1.6 — fixed in 1.7.79, 2.1.6
@clerk Clerk/Fastify: from 1.0.42 before 2.6.31; from 3.0.0 before 3.1.16 — fixed in 2.6.31, 3.1.16
@clerk Clerk/Hono: from 0.0.2 before 0.1.16 — fixed in 0.1.16
@clerk Clerk/Nextjs: from 6.0.0 through 6.39.3; from 7.0.0 before 7.2.4 — fixed in 7.2.4
@clerk Clerk/Nuxt: from 1.0.0 before 1.13.29; from 2.0.0 before 2.2.5 — fixed in 1.13.29, 2.2.5
@clerk Clerk/React: from 6.0.0 before 6.4.3 — fixed in 6.4.3
@clerk Clerk/React-Router: from 0.0.1 before 2.4.13; from 3.0.0 before 3.1.4 — fixed in 2.4.13, 3.1.4
@clerk Clerk/Shared: from 3.0.0 before 3.47.5; from 4.0.0 before 4.8.3 — fixed in 3.47.5, 4.8.3
@clerk Clerk/Tanstack-React-Start: from 0.0.1 before 0.29.11; from 1.0.0 before 1.1.4 — fixed in 0.29.11, 1.1.4
@clerk Clerk/Vue: from 1.0.0 before 1.17.21; from 2.0.0 before 2.0.16 — fixed in 1.17.21, 2.0.16

How to fix

Upgrade to a fixed version: @clerk Clerk/Astro 2.17.11, 3.0.18; @clerk Clerk/Backend 2.33.3, 3.2.14; @clerk Clerk/Chrome-Extension 2.9.15, 3.1.15; @clerk Clerk/Clerk-Expo 2.19.36; @clerk Clerk/Clerk-Js 5.125.10, 6.7.5; @clerk Clerk/Clerk-React 5.61.6; @clerk Clerk/Expo 3.2.2; @clerk Clerk/Express 1.7.79, 2.1.6; @clerk Clerk/Fastify 2.6.31, 3.1.16; @clerk Clerk/Hono 0.1.16; @clerk Clerk/Nextjs 7.2.4; @clerk Clerk/Nuxt 1.13.29, 2.2.5. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-42349 or the next vulnerability affects your stack