clerk/javascript · Security
@clerk/nextjs auth() and getAuth() methods vulnerable to insecure direct object reference (IDOR)
- GHSA ID
- GHSA-q6w5-jg5q-47vg
- CVE ID
- CVE-2024-22206
- Severity
- critical
- Published
- Updated
- CVSS
- 9 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
- CVSS v3
- 9 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Description
Impact
Unauthorized access or privilege escalation due to a logic flaw in auth() in the App Router or getAuth() in the Pages Router.
Affected Versions
All applications that that use @clerk/nextjs versions in the range of >= 4.7.0,< 4.29.3 in a Next.js backend to authenticate API Routes, App Router, or Route handlers. Specifically, those that call auth() in the App Router or getAuth() in the Pages Router. Only the @clerk/nextjs SDK is impacted. Other SDKs, including other Javascript-based SDKs, are not impacted.
Patches
Fix included in @clerk/[email protected].
References
CWEs
- CWE-284 · Improper Access Control
- CWE-287 · Improper Authentication
- CWE-639 · Authorization Bypass Through User-Controlled Key