CVE-2025-53548: Insufficient Verification of Data Authenticity in @clerk/backend and Related Packages
Summary
CVE-2025-53548: @clerk/backend Performs Insufficient Verification of Data Authenticity. Affects @clerk/backend versions >= 2.0.0, < 2.4.0. Fixed in 2.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @clerk/backend package is a part of the Clerk authentication suite, which provides backend services for user authentication and management. It is designed to simplify the integration of user authentication into applications, offering features such as webhook support for event handling. However, a vulnerability has been identified that affects the integrity of webhook events, potentially allowing improperly signed events to be accepted by applications.
Vulnerability Detail
The vulnerability arises from the insufficient verification of incoming webhook signatures in the @clerk/backend package and its related packages. This flaw allows attackers to send forged webhook events, which can lead to unauthorized actions being executed within the application. The issue is particularly concerning as it compromises the authenticity of data received from Clerk, potentially leading to data breaches or unauthorized access.
How To Fix
Minimum fixed version
2.4.0
This is the first release that contains the fix.
npm install @clerk/backend@2.4.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not feasible, developers can manually verify webhooks by implementing custom verification logic. This can be done by comparing the received webhook signature with a locally generated signature based on the event data. For detailed instructions, refer to the Clerk documentation on webhook protection: https://clerk.com/docs/webhooks/overview#protect-your-webhooks-from-abuse.
Conclusion
In summary, CVE-2025-53548 represents a significant security risk for applications using the @clerk/backend package and its related packages. It is crucial to apply the necessary updates to mitigate this vulnerability and ensure the integrity of webhook events.
See every vulnerability recorded for @clerk/backend →
FAQ
CVE-2025-53548 is a vulnerability affecting the @clerk/backend package and its related packages, which allows for insufficient verification of webhook signatures.
This vulnerability can lead to the acceptance of improperly signed webhook events, potentially allowing unauthorized actions within your application.
You should update the affected packages to their patched versions as specified in the 'how to fix' section.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application using the Vulert playground without any signup.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for @clerk/backend.
