Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-sumx-ubek-sbhe
Vulnerability ID VCID-sumx-ubek-sbhe
Aliases CVE-2026-42349
GHSA-w24r-5266-9c3c
Summary Clerk JavaScript is the official JavaScript repository for Clerk authentication. has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result should be false, allowing a gated action to proceed for a user who does not satisfy the full set of requested conditions. This call shape can be bypassed if certain conditions are met: a has() or auth.protect() call that combines a reverification check with any of role, permission, feature, or plan, or that combines a billing check (feature or plan) with a role or permission check. This vulnerability is fixed in @clerk/clerk-js 5.125.10 and 6.7.5.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-754 Improper Check for Unusual or Exceptional Conditions
CWE-863 Incorrect Authorization
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00049 https://api.first.org/data/v1/epss?cve=CVE-2026-42349
epss 0.00056 https://api.first.org/data/v1/epss?cve=CVE-2026-42349
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-w24r-5266-9c3c
cvssv3.1 8.1 https://github.com/clerk/javascript
cvssv4 7.6 https://github.com/clerk/javascript
generic_textual HIGH https://github.com/clerk/javascript
cvssv3.1 8.1 https://github.com/clerk/javascript/security/advisories/GHSA-w24r-5266-9c3c
cvssv3.1_qr HIGH https://github.com/clerk/javascript/security/advisories/GHSA-w24r-5266-9c3c
cvssv4 7.6 https://github.com/clerk/javascript/security/advisories/GHSA-w24r-5266-9c3c
generic_textual HIGH https://github.com/clerk/javascript/security/advisories/GHSA-w24r-5266-9c3c
ssvc Track https://github.com/clerk/javascript/security/advisories/GHSA-w24r-5266-9c3c
cvssv3.1 8.1 https://nvd.nist.gov/vuln/detail/CVE-2026-42349
cvssv4 7.6 https://nvd.nist.gov/vuln/detail/CVE-2026-42349
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2026-42349
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2026-42349
https://github.com/clerk/javascript
https://nvd.nist.gov/vuln/detail/CVE-2026-42349
GHSA-w24r-5266-9c3c https://github.com/advisories/GHSA-w24r-5266-9c3c
GHSA-w24r-5266-9c3c https://github.com/clerk/javascript/security/advisories/GHSA-w24r-5266-9c3c
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://github.com/clerk/javascript
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N Found at https://github.com/clerk/javascript
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://github.com/clerk/javascript/security/advisories/GHSA-w24r-5266-9c3c
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N Found at https://github.com/clerk/javascript/security/advisories/GHSA-w24r-5266-9c3c
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-14T18:18:41Z/ Found at https://github.com/clerk/javascript/security/advisories/GHSA-w24r-5266-9c3c
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2026-42349
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N Found at https://nvd.nist.gov/vuln/detail/CVE-2026-42349
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.15627
EPSS Score 0.00049
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T16:44:14.812355+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2026/42xxx/CVE-2026-42349.json 38.6.0