Clerk has an authorization bypass when combining organization, billing, or reverification checks - @clerk/shared
- Severity:
- High
Description
has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result should be false, allowing a gated action to proceed for a user who does not satisfy the full set of requested conditions.
Recommendation
Update the @clerk/shared package to the latest compatible version. Followings are version details:
Affected version(s): **>= 4.0.0, <= 4.8.2 >= 3.0.0, <= 3.47.4** Patched version(s): **4.8.3 3.47.5**
References
Related Issues
- Clerk has an authorization bypass when combining organization, billing, or reverification checks - @clerk/clerk-js - CVE-2026-42349
- Clerk has an authorization bypass when combining organization, billing, or reverification checks - @clerk/clerk-expo - CVE-2026-42349
- Clerk has an authorization bypass when combining organization, billing, or reverification checks - @clerk/chrome-extension - CVE-2026-42349
- Clerk has an authorization bypass when combining organization, billing, or reverification checks - @clerk/backend - CVE-2026-42349
You might also like:
- Tags:
- npm
- @clerk/shared
Anything's wrong? Let us know Last updated on June 09, 2026