CVE-2024-22206 @clerk/nextjs auth() and getAuth() methods vulnerable to insecure direct object reference (IDOR)
Attackers can bypass authentication checks in Clerk's Next.js library to access unauthorized data or escalate privileges.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-22206?
CVE-2024-22206 is a critical missing authorization vulnerability in clerk javascript, published on 12 Jan 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Clerk helps developers build user management. Unauthorized access or privilege escalation due to a logic flaw in auth() in the App Router or getAuth() in the Pages Router. This vulnerability was patched in version 4.29.3.
Which versions are affected by CVE-2024-22206?
2 open source packages ship an affected version, including @clerk/nextjs. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@clerk/nextjs npm | From 4.7.0 | 4.29.3 |
@clerk/nextjs npm | From 4.7.0 | 4.29.3 |
Products include Clerk Javascript.
How do I fix CVE-2024-22206?
Upgrade @clerk/nextjs to 4.29.3 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-22206 being exploited?
There is no known exploitation of CVE-2024-22206 in the wild and no public exploit code.
Sources
Also known as GHSA-q6w5-jg5q-47vg.