clerk react vulnerabilities

Latest clerk react CVEs

Newest publication first

1. CVE-2026-42349 Clerk: Authorization bypass when combining organization, billing, or reverification checks

   Published 2026-05-11

   High·CVSS 7.6

   Clerk JavaScript is the official JavaScript repository for Clerk authentication. has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when th...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.