CVE-2026-42349 Clerk: Authorization bypass when combining organization, billing, or reverification checks
Attackers can bypass combined authorization checks in Clerk SDKs, allowing unauthorized access to gated actions when specific conditions are met.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-42349?
CVE-2026-42349 is a high-severity authentication bypass vulnerability in @clerk astro, published on 11 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Clerk JavaScript is the official JavaScript repository for Clerk authentication. has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result should be false, allowing a gated action to proceed for a user who does not satisfy the full set of requested conditions. This call shape can be bypassed if certain conditions are met: a has() or auth.protect() call that combines a reverification check with any of role, permission, feature, or plan, or that combines a billing check (feature or plan) with a role or permission check. This vulnerability is fixed in @clerk/clerk-js 5.125.10 and 6.7.5.
Which versions are affected by CVE-2026-42349?
40 open source packages ship an affected version, including @clerk/astro, @clerk/backend and @clerk/chrome-extension. It affects 17 products.
| Package | Affected | Fixed in |
|---|---|---|
@clerk/astro npm | From 2.0.0 | 2.17.11 |
@clerk/astro npm | From 2.0.0 | 2.17.11 |
@clerk/astro npm | From 3.0.0 | 3.0.18 |
@clerk/astro npm | From 3.0.0 | 3.0.18 |
@clerk/backend npm | From 2.0.0 | 2.33.3 |
@clerk/backend npm | From 2.0.0 | 2.33.3 |
34 more packages
@clerk/backend npm | From 3.0.0 | 3.2.14 |
@clerk/backend npm | From 3.0.0 | 3.2.14 |
@clerk/chrome-extension npm | From 1.3.5 | 2.9.15 |
@clerk/chrome-extension npm | From 1.3.5 | 2.9.15 |
@clerk/chrome-extension npm | From 3.0.0 | 3.1.15 |
@clerk/chrome-extension npm | From 3.0.0 | 3.1.15 |
@clerk/clerk-expo npm | From 2.2.11 | 2.19.36 |
@clerk/clerk-expo npm | From 2.2.11 | 2.19.36 |
@clerk/clerk-js npm | From 5.22.0 | 5.125.10 |
@clerk/clerk-js npm | From 5.22.0 | 5.125.10 |
@clerk/clerk-js npm | From 6.0.0 | 6.7.5 |
@clerk/clerk-js npm | From 6.0.0 | 6.7.5 |
@clerk/clerk-react npm | From 5.9.0 | 5.61.6 |
@clerk/clerk-react npm | From 5.9.0 | 5.61.6 |
@clerk/expo npm | From 3.0.0 | 3.2.2 |
@clerk/expo npm | From 3.0.0 | 3.2.2 |
@clerk/express npm | From 0.1.0 | 1.7.79 |
@clerk/express npm | From 0.1.0 | 1.7.79 |
@clerk/express npm | From 2.0.0 | 2.1.6 |
@clerk/express npm | From 2.0.0 | 2.1.6 |
@clerk/fastify npm | From 1.0.42 | 2.6.31 |
@clerk/fastify npm | From 1.0.42 | 2.6.31 |
@clerk/fastify npm | From 3.0.0 | 3.1.16 |
@clerk/fastify npm | From 3.0.0 | 3.1.16 |
@clerk/hono npm | From 0.0.2 | 0.1.16 |
@clerk/hono npm | From 0.0.2 | 0.1.16 |
@clerk/nextjs npm | From 6.0.0 | 6.39.3 |
@clerk/nextjs npm | From 6.0.0 | 6.39.3 |
@clerk/nextjs npm | From 7.0.0 | 7.2.4 |
@clerk/nextjs npm | From 7.0.0 | 7.2.4 |
@clerk/nuxt npm | From 1.0.0 | 1.13.29 |
@clerk/nuxt npm | From 1.0.0 | 1.13.29 |
@clerk/nuxt npm | From 2.0.0 | 2.2.5 |
@clerk/nuxt npm | From 2.0.0 | 2.2.5 |
Products include Clerk Clerk\/Astro, Clerk Clerk\/Backend, Clerk Clerk\/Chrome-Extension, Clerk Clerk\/Clerk-Expo, Clerk Clerk\/Clerk-Js, Clerk Clerk\/Clerk-React and 11 more.
How do I fix CVE-2026-42349?
Upgrade @clerk/astro to a fixed version for your release line: 2.17.11 or 3.0.18.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-42349 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-42349 exists.
Sources
Also known as GHSA-w24r-5266-9c3c.