https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 00:55:42 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-318583 EUVD-2026-318583 https://cve.radiocsirt.org/vuln/euvd-2026-318583 https://cve.radiocsirt.org/vuln/fkie_cve-2026-42349 <p>Clerk JavaScript is the official JavaScript repository for Clerk authentication. has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result should be false, allowing a gated action to proceed for a user who does not satisfy the full set of requested conditions. This call shape can be bypassed if certain conditions are met: a has() or auth.protect() call that combines a reverification check with any of role, permission, feature, or plan, or that combines a billing check (feature or plan) with a role or permission check. This vulnerability is fixed in @clerk/clerk-js 5.125.10 and 6.7.5.</p> <p>Clerk JavaScript is the official JavaScript repository for Clerk authentication. has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result should be false, allowing a gated action to proceed for a user who does not satisfy the full set of requested conditions. This call shape can be bypassed if certain conditions are met: a has() or auth.protect() call that combines a reverification check with any of role, permission, feature, or plan, or that combines a billing check (feature or plan) with a role or permission check. This vulnerability is fixed in @clerk/clerk-js 5.125.10 and 6.7.5.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-42349 https://cve.radiocsirt.org/vuln/ghsa-w24r-5266-9c3c <p><strong>Affected:</strong> npm: @clerk/shared, npm: @clerk/backend, npm: @clerk/nextjs, npm: @clerk/clerk-js, npm: @clerk/clerk-react, npm: @clerk/react, npm: @clerk/vue, npm: @clerk/astro, npm: @clerk/nuxt, npm: @clerk/clerk-expo and 7 more</p> <p>### Summary</p> <p>`has()`, `auth.protect()`, and related authorization predicates in `@clerk/shared`, `@clerk/nextjs`, `@clerk/backend`, and other framework SDKs can return true for certain combined authorization checks when the result should be false, allowing a gated action to proceed for a user who does not satisfy the full set of requested conditions.</p> <p>Sessions are not compromised and no existing user can be impersonated. The bypass is limited to the authorization decision returned by the predicate. `clerkMiddleware` continues to authenticate requests correctly, `auth()` reflects the real authentication state, and token verification is unaffected.</p> <p>### Who is affected</p> <p>All apps that combine more than one authorization dimension in a single `has()` or `auth.protect()` call should upgrade to the patched versions. Patches are drop-in with no API changes. The information below describes the scope of the bypass and helps developers understand whether their apps are potentially affected, but is not a reason to delay the upgrade.</p> <p>This call shape can be bypassed if certain conditions are met: a `has()` or `auth.protect()` call that combines a `reverification` check with any of `role`, `permission`, `feature`, or `plan`, or that combines a billing check (`feature` or `plan`) with a role or permission check.</p> <p>```ts // Reverification combined with role / permission / feature / plan await auth.protect({ permission: &#39;org:settings:delete&#39;, reverification: &#39;strict&#39; }); const canAct = has(…</p> <p><strong>Affected:</strong> npm: @clerk/shared, npm: @clerk/backend, npm: @clerk/nextjs, npm: @clerk/clerk-js, npm: @clerk/clerk-react, npm: @clerk/react, npm: @clerk/vue, npm: @clerk/astro, npm: @clerk/nuxt, npm: @clerk/clerk-expo and 7 more</p> <p>### Summary</p> <p>`has()`, `auth.protect()`, and related authorization predicates in `@clerk/shared`, `@clerk/nextjs`, `@clerk/backend`, and other framework SDKs can return true for certain combined authorization checks when the result should be false, allowing a gated action to proceed for a user who does not satisfy the full set of requested conditions.</p> <p>Sessions are not compromised and no existing user can be impersonated. The bypass is limited to the authorization decision returned by the predicate. `clerkMiddleware` continues to authenticate requests correctly, `auth()` reflects the real authentication state, and token verification is unaffected.</p> <p>### Who is affected</p> <p>All apps that combine more than one authorization dimension in a single `has()` or `auth.protect()` call should upgrade to the patched versions. Patches are drop-in with no API changes. The information below describes the scope of the bypass and helps developers understand whether their apps are potentially affected, but is not a reason to delay the upgrade.</p> <p>This call shape can be bypassed if certain conditions are met: a `has()` or `auth.protect()` call that combines a `reverification` check with any of `role`, `permission`, `feature`, or `plan`, or that combines a billing check (`feature` or `plan`) with a role or permission check.</p> <p>```ts // Reverification combined with role / permission / feature / plan await auth.protect({ permission: &#39;org:settings:delete&#39;, reverification: &#39;strict&#39; }); const canAct = has(…</p> https://cve.radiocsirt.org/vuln/ghsa-w24r-5266-9c3c