CVE-2026-42349: Clerk Package Authorization Bypass Vulnerability
Summary
CVE-2026-42349: Clerk has an authorization bypass when combining organization, billing, or reverification checks. Affects @clerk/shared across 2 version ranges.
>= 3.0.0, < 3.47.5
>= 4.0.0, < 4.8.3
Fixed in 3.47.5 or 4.8.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Clerk package is a popular authentication and user management solution for web applications, offering features such as user sessions, role-based access control, and integration with various frameworks. This package is widely used in applications that require secure user authentication and authorization mechanisms. However, a recent vulnerability has been identified that affects the authorization checks within Clerk, potentially allowing unauthorized actions under specific conditions.
Vulnerability Detail
The vulnerability arises from the has(), auth.protect(), and related authorization predicates in the Clerk SDKs, which can incorrectly return true for combined authorization checks that should fail. This flaw allows users to bypass certain authorization requirements when multiple checks are combined, leading to unauthorized access to gated actions. Although sessions remain secure and cannot be exploited for impersonation, the integrity of the authorization logic is compromised, which could lead to unauthorized operations in applications relying on these checks.
How To Fix
Latest published version: 4.41.0 as of 23 Oct 2026
npm install @clerk/shared@4.41.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 3.0.0, < 3.47.53.47.5npm install @clerk/shared@3.47.5 -
>= 4.0.0, < 4.8.34.8.3npm install @clerk/shared@4.8.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate upgrading is not feasible, developers can implement a workaround by splitting combined has() or `
auth.protect()` calls into sequential single-condition checks. For example, replace: await auth.protect({ permission: 'org:X', reverification: 'strict' });
with: await
auth.protect({ reverification: 'strict' });
await
auth.protect({ permission: 'org:X' });
This ensures that each check fails closed as expected.
Conclusion
In summary, the CVE-2026-42349 vulnerability in the Clerk package poses a significant risk by allowing authorization bypass under certain conditions. It is crucial for developers to upgrade to the patched versions of the affected packages or implement the suggested workaround to maintain the integrity of their applications' authorization mechanisms.
See every vulnerability recorded for @clerk/shared →
FAQ
The vulnerability allows an authorization bypass when combining multiple checks in Clerk, potentially enabling unauthorized actions.
All applications using Clerk that combine multiple authorization checks in a single call are affected.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against this vulnerability using the Vulert playground.
Implement the provided workaround by separating combined authorization checks into individual calls.
The CVSS score for this vulnerability is 7.6, indicating a high severity level.
