Description
has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result should be false, allowing a gated action to proceed for a user who does not satisfy the full set of requested conditions.
Recommendation
Update the @clerk/nextjs package to the latest compatible version. Followings are version details:
Affected version(s): **>= 7.0.0, <= 7.2.3 >= 6.0.0, <= 6.39.2** Patched version(s): **7.2.4 6.39.3**
References
Could your website be exposed too?
SmartScanner can check your website for Clerk has an authorization bypass when combining organization, billing, or reverification checks - @clerk/nextjs and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Clerk has an authorization bypass when combining organization, billing, or reverification checks - CVE-2026-42349
- Clerk has an authorization bypass when combining organization, billing, or reverification checks - @clerk/vue - CVE-2026-42349
- Clerk has an authorization bypass when combining organization, billing, or reverification checks - @clerk/shared - CVE-2026-42349
- Clerk has an authorization bypass when combining organization, billing, or reverification checks - @clerk/react - CVE-2026-42349
You might also like:
See something that needs correcting? Let us knowUpdated June 09, 2026