Listen to this Post
How the mentioned CVE works:
The vulnerability exists in Clerk’s authorization predicates (has(), auth.protect()) across @clerk/shared, @clerk/nextjs, @clerk/backend, and related SDKs. When an application combines two or more authorization dimensions in a single call, the check may incorrectly return true, allowing a user to bypass gated actions. Specifically, combining a “reverification” check with any of role, permission, feature, or plan causes the flaw. Similarly, combining a billing check (feature or plan) with role or permission also triggers the bypass. For example, calling auth.protect({ permission: ‘org:settings:delete’, reverification: ‘strict’ }) may return true even if the user lacks the permission. Another bypass in @clerk/nextjs silently discards authorization params (role, permission, feature, plan, reverification) when the same object contains unauthenticatedUrl, unauthorizedUrl, or token. Single-condition checks remain secure, failing closed. The callback form of auth.protect is unaffected unless the callback itself invokes an affected shape. Sessions and authentication are not compromised; only the authorization decision is wrong. The flaw was introduced in vulnerable versions listed in the advisory. The fix patches the logic without API changes. Developers must upgrade to patched versions (Core 2 and Core 3 lines). A workaround splits combined calls into sequential single-condition checks. The issue was reported on 18 APR 2026 and patched on 22 APR 2026.
dailycve form:
Platform: Clerk SDKs An attacker with a valid session but lacking required permissions can trigger the bypass by crafting a request that invokes a combined has() or auth.protect() call with reverification+billing or billing+role/permission. For example, if an app uses Upgrade immediately to the latest patched versions: @clerk/[email protected]+, @clerk/[email protected]+, @clerk/[email protected]+ (exact patch versions per advisory). If upgrade is impossible, rewrite combined authorization calls as sequential single-condition checks. Avoid passing unauthenticatedUrl, unauthorizedUrl, or token in the same object as authorization params. Monitor Clerk’s security advisories for updates. Unauthorized users may perform protected actions (e.g., delete org settings, access premium features) that require multiple conditions. However, session integrity, authentication, and token verification remain intact. No impersonation or privilege escalation beyond the flawed authorization decision. Affects all apps using Clerk SDKs with multi-dimensional has() or auth.protect() calls. Reported By: github.com
Version: What Undercode Say:
Check installed @clerk/shared version
npm why @clerk/shared
Upgrade framework package (Next.js example)
npm install @clerk/nextjs@latest
Verify patch by inspecting version
npm list @clerk/nextjs
Workaround: split combined call
Instead of:
await auth.protect({ permission: 'org:X', reverification: 'strict' });
Use sequential checks:
await auth.protect({ reverification: 'strict' });
await auth.protect({ permission: 'org:X' });
Exploit:
has({ role: 'org:admin', feature: 'premium' }), an unprivileged user may still receive true. In Next.js apps, passing `{ permission: ‘org:admin’, unauthenticatedUrl: ‘/’ }` to auth.protect() discards the permission check entirely, granting access.Protection from this CVE:
Impact:
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Extra Source Hub:
Undercode🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow DailyCVE & Stay Tuned:
