← Vulnerability feed

Vulnerability record · CVE-2026-42349 · published 11 May 2026

CVE-2026-42349: Clerk\/astro incorrect authorization vulnerability

Clerk · Clerk\/Astro

Clerk JavaScript is the official JavaScript repository for Clerk authentication. has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result should be false, allowing a gated action to proceed for a user who does not satisfy the full set of requested conditions. This call shape can be bypassed if certain conditions are met: a has() or auth.protect() call that combines a reverification check with any of role, permission, feature, or plan, or that combines a billing check (feature or plan) with a role or permission check. This vulnerability is fixed in @clerk/clerk-js 5.125.10 and 6.7.5.

7.6 CVSS 4.0 High EPSS 0.43% · top 64.8% CWE-754 · CWE-754CWE-863 · Incorrect authorization
7.6CVSS 4.0 base score
0.43%EPSS exploitation probability, 30 days
NoNot in CISA KEV
17Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

Clerk JavaScript is the official JavaScript repository for Clerk authentication. has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result should be false, allowing a gated action to proceed for a user who does not satisfy the full set of requested conditions. This call shape can be bypassed if certain conditions are met: a has() or auth.protect() call that combines a reverification check with any of role, permission, feature, or plan, or that combines a billing check (feature or plan) with a role or permission check. This vulnerability is fixed in @clerk/clerk-js 5.125.10 and 6.7.5.

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

17 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/clerk/javascript/security/advisories/GHSA-w24r-5266-9c3c MitigationVendor Advisory
https://github.com/clerk/javascript/security/advisories/GHSA-w24r-5266-9c3c MitigationVendor Advisory

Track CVE-2026-42349 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2025-39682Linux kernel TLS zero-length record handling flaw on rx_listThe Linux kernel TLS receive path mishandles zero-length records that arrive from the rx_list, breaking the assumption that a record type change cann…KEVEPSS 2.9%analysed8.7CVE-2024-3393PAN-OS DNS Security packet causes firewall reboot and maintenance modeA denial of service flaw in the DNS Security feature of Palo Alto Networks PAN-OS lets an unauthenticated attacker send a crafted packet through the …KEVEPSS 28%analysed8.8CVE-2023-41993Apple WebKit improper check allows arbitrary code executionCVE-2023-41993 is a WebKit flaw where processing web content can lead to arbitrary code execution, addressed with improved checks. Apple states it is…KEVEPSS 24%analysed7.8CVE-2023-41992Apple kernel privilege escalation via insufficient checksApple kernel code did not perform adequate checks, allowing a local attacker to elevate privileges. Apple states it is aware of a report that this is…KEVEPSS 9.5%analysed7.8CVE-2021-3560polkit D-Bus credential check bypass allows local root escalationpolkit can be tricked into bypassing credential checks for D-Bus requests, letting an unprivileged local user elevate to root. Because polkit is a co…KEVEPSS 24%analysed

Source: NIST National Vulnerability Database (record CVE-2026-42349), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.