Listen to this Post
How the mentioned CVE works:
The vulnerability in Clerk-js version 5.88.0 resides in the OAuth one-time password (OTP) verification logic. During the OAuth flow, after a user initiates a sign-in via a third-party provider, they are redirected back to the application with an OTP for final authentication. The flaw allows an attacker to intercept or manipulate the client-side request containing the OTP. By modifying the payload or reusing a captured OTP, the authentication state can be illicitly confirmed without possessing the actual OTP. This bypasses the final verification step, granting unauthorized access to the victim’s account because the system fails to properly validate the OTP’s uniqueness, expiration, or its binding to the initial OAuth session.
DailyCVE Form:
Platform: Clerk-js
Version: 5.88.0
Vulnerability : OAuth Bypass
Severity: Moderate
date: 2025-11-20
Prediction: Patch by 2025-11-27
What Undercode Say:
Simulating a request to the OTP verification endpoint
curl -X POST https://api.clerk.com/v1/oauth/verify_otp \
-H "Content-Type: application/json" \
-d '{"otp":"CAPTURED_OR_MODIFIED_OTP", "session_id":"ATTACKER_SESSION"}'
Example of a vulnerable code pattern (conceptual)
The server-side code might lack checks like:
if (!isValidOTP(otp, original_session_id)) {
// Fail authentication
}
// Client-side manipulation concept
// Attacker intercepts and modifies the fetch request
fetch('/verify-otp', {
method: 'POST',
body: JSON.stringify({ otp: maliciously_obtained_otp })
});
How Exploit:
Attacker initiates OAuth flow, captures the OTP request via proxy, and modifies the session identifier or OTP value before it is verified by the server, leading to an unauthorized authentication.
Protection from this CVE:
Update Clerk-js to the patched version immediately upon release. Implement server-side checks ensuring the OTP is valid, non-reusable, strictly tied to the original OAuth session, and has not expired.
Impact:
Unauthorized account access, complete compromise of user authentication for applications relying on Clerk-js OAuth flows.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
