CVE-2026-42349: 
JavaScript vulnerability analysis and mitigation

CVE-2026-42349 is an authorization bypass vulnerability in Clerk JavaScript SDKs, where the has(), auth.protect(), and related authorization predicates can incorrectly return true for certain combined authorization checks, allowing gated actions to proceed for users who do not satisfy the full set of required conditions. It affects a broad range of Clerk npm packages including @clerk/clerk-js, @clerk/nextjs, @clerk/backend, @clerk/shared, and over a dozen other framework SDKs across both Core 2 and Core 3 release lines. The vulnerability was reported on April 18, 2026, patched on April 22, 2026, and publicly disclosed on April 30, 2026. It carries a CVSS v3.1 base score of 8.1 (High) and a CVSS v4.0 base score of 7.6 (High) (Github Advisory, Clerk Advisory).

The root cause is classified as CWE-754 (Improper Check for Unusual or Exceptional Conditions) and CWE-863 (Incorrect Authorization). The flaw exists in the createCheckAuthorization logic within @clerk/shared, which is consumed by all framework packages. When a single has() or auth.protect() call combines a reverification check with a role, permission, feature, or plan check — or combines a billing check (feature/plan) with a role or permission check — the predicate evaluates the combined condition incorrectly and may return true when it should return false. A secondary bypass in @clerk/nextjs causes auth.protect() to silently discard authorization parameters (role, permission, feature, plan, reverification) when the same argument object also contains unauthenticatedUrl, unauthorizedUrl, or token. Single-condition checks and the callback form of auth.protect() are not affected (Github Advisory, Clerk Advisory).

Successful exploitation allows an authenticated but insufficiently privileged user to bypass authorization gates and access features or perform actions they are not entitled to — such as accessing premium billing features without the required plan, or performing privileged organization actions without the required role. Confidentiality and integrity of the vulnerable system are both rated High, as an attacker could read sensitive gated data and make unauthorized modifications. Importantly, sessions are not compromised, no user can be impersonated, and token verification remains unaffected; the bypass is strictly limited to the authorization decision returned by the affected predicates (Github Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability requires the attacker to already be an authenticated (low-privileged) user of the target application, and the application must use combined authorization checks in the affected call shapes. The EPSS score is approximately 0.049% (16th percentile), indicating a low near-term exploitation probability. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability was responsibly disclosed by AISafe (Github Advisory, Clerk Advisory).

1. Identify a target application: Find a web application using Clerk authentication that employs combined authorization checks (e.g., combining reverification with role/permission, or feature/plan with role/permission) in has() or auth.protect() calls.
2. Obtain a low-privileged account: Register or log in as a standard authenticated user who does not hold the required role, permission, plan, or has not completed reverification.
3. Identify gated endpoints or features: Probe the application for routes or actions protected by combined Clerk authorization predicates (e.g., admin-only settings, premium billing features, or actions requiring step-up authentication).
4. Send a crafted request: As the authenticated low-privileged user, directly access the gated endpoint or trigger the gated action via a normal HTTP request. Due to the faulty predicate evaluation, the combined check returns true despite the user not satisfying all conditions.
5. Access unauthorized resources: The application proceeds with the gated action, granting the attacker access to sensitive data or the ability to perform privileged operations they are not authorized for (Github Advisory, Clerk Advisory).

• Logs: Application-level access logs showing low-privileged users successfully accessing routes or features that should require elevated roles, specific permissions, billing plans, or step-up (reverification) authentication.
• Logs: Absence of reverification challenge events for users who accessed reverification-gated resources, despite not having completed the step-up flow.
• Application Behavior: Users without premium plan entitlements accessing billing-gated features; users without admin roles performing organization-level administrative actions.
• Audit Trails: Clerk session/audit logs showing successful authorization decisions for users who lack the required role, permission, plan, or feature — particularly for actions that combine multiple authorization dimensions.

The primary remediation is to upgrade all Clerk SDK packages to their respective patched versions. Key patched versions include: @clerk/clerk-js 5.125.10 / 6.7.5, @clerk/shared 3.47.5 / 4.8.3, @clerk/nextjs 6.39.3 / 7.2.4, @clerk/backend 2.33.3 / 3.2.14, and corresponding patches for @clerk/express, @clerk/fastify, @clerk/astro, @clerk/vue, @clerk/nuxt, @clerk/react, @clerk/react-router, @clerk/hono, @clerk/expo, @clerk/chrome-extension, and @clerk/tanstack-react-start. Most apps loading @clerk/clerk-js from Clerk's CDN via their framework package will receive the fix automatically without a manual upgrade. As a workaround if immediate upgrade is not possible, split combined has() or auth.protect() calls into sequential single-condition checks — each single-condition check fails closed as expected (Github Advisory, Clerk Advisory).

The vulnerability was responsibly disclosed by AISafe and patched by Clerk within four days of the report. Clerk published a detailed security advisory authored by nikosdouvlis on April 22, 2026, providing clear scope description, affected package ranges, workarounds, and a remediation timeline. No significant broader media coverage or notable independent researcher commentary has been identified beyond the official advisory (Clerk Advisory).