Description
has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result should be false, allowing a gated action to proceed for a user who does not satisfy the full set of requested conditions.
Recommendation
Update the @clerk/tanstack-react-start package to the latest compatible version. Followings are version details:
Affected version(s): **>= 1.0.0, <= 1.1.3 >= 0.0.1, <= 0.29.10** Patched version(s): **1.1.4 0.29.11**
References
Could your website be exposed too?
SmartScanner can check your website for Clerk has an authorization bypass when combining organization, billing, or reverification checks and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Clerk has an authorization bypass when combining organization, billing, or reverification checks - @clerk/clerk-js - CVE-2026-42349
- Clerk has an authorization bypass when combining organization, billing, or reverification checks - @clerk/clerk-expo - CVE-2026-42349
- Clerk has an authorization bypass when combining organization, billing, or reverification checks - @clerk/chrome-extension - CVE-2026-42349
- Clerk has an authorization bypass when combining organization, billing, or reverification checks - @clerk/backend - CVE-2026-42349
You might also like:
See something that needs correcting? Let us knowUpdated June 09, 2026