Clerk has an authorization bypass when combining organization, billing, or reverification checks — CVE-2026-42349

Summary

### Summary `has()`, `auth.protect()`, and related authorization predicates in `@clerk/shared`, `@clerk/nextjs`, `@clerk/backend`, and other framework SDKs can return true for certain combined authorization checks when the result should be false, allowing a gated action to proceed for a user who does not satisfy the full set of requested conditions. Sessions are not compromised and no existing user can be…

Product

npm: @clerk/shared | npm: @clerk/backend | npm: @clerk/nextjs | npm: @clerk/clerk-js | npm: @clerk/clerk-react | npm: @clerk/react | npm: @clerk/vue | npm: @clerk/astro | +9

What to do

General, cautious steps (verify details in the official source):

• Prioritize patching or mitigation immediately (treat as actively risky).
• Identify affected product versions in your inventory and verify whether you are impacted.
• Apply vendor patches/updates or recommended mitigations as soon as available.
• Read the official advisory for exact affected versions and remediation steps.

Official advisory

• Read the official source
• CVE Record
• NVD

Related advisories