clerk/javascript Security Advisories | GitStock

high2026-04-30

Clerk has an authorization bypass when combining organization, billing, or reverification checks

GHSA-w24r-5266-9c3c · CVE-2026-42349

critical2026-04-16

Official Clerk JavaScript SDKs: Middleware-based route protection bypass

GHSA-vqx2-fgx2-5wq9 · CVE-2026-41248

high2026-03-27

Clerk: SSRF in the opt-in clerkFrontendApiProxy feature may leak secret keys to unintended host

GHSA-gjxx-92w9-8v8f · CVE-2026-34076

medium2025-11-20

Clerk-js vulnerable to bypass of OAuth authentication flow by manipulating request at OTP verification stage

GHSA-3mm3-wfpv-q85g · CVE-2025-63700

high2025-07-09

@clerk/backend Performs Insufficient Verification of Data Authenticity

GHSA-9mp4-77wg-rwx9 · CVE-2025-53548

critical2024-01-12

@clerk/nextjs auth() and getAuth() methods vulnerable to insecure direct object reference (IDOR)

GHSA-q6w5-jg5q-47vg · CVE-2024-22206