7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-53548

CVE-2025-53548: @clerk/backend Performs Insufficient Verification of Data Authenticity

Impact

Applications that use the verifyWebhook() helper to verify incoming Clerk webhooks are susceptible to accepting improperly signed webhook events.

Patches

@clerk/backend: the helper has been patched as of 2.4.0
@clerk/astro: the helper has been patched as of 2.10.2
@clerk/express: the helper has been patched as of 1.7.4
@clerk/fastify: the helper has been patched as of 2.4.4
@clerk/nextjs: the helper has been patched as of 6.23.3
@clerk/nuxt: the helper has been patched as of 1.7.5
@clerk/react-router: the helper has been patched as of 1.6.4
@clerk/remix: the helper has been patched as of 4.8.5
@clerk/tanstack-react-start: the helper has been patched as of 0.18.3

Resolution

The issue was resolved in @clerk/backend 2.4.0 by:

Properly parsing the webhook request's signatures and comparing them against the signature generated from the received event

Workarounds

If unable to upgrade, developers can workaround this issue by verifying webhooks manually, per this documentation.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-53548

CVE-2025-53548:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@clerk/backend	npm	>= 2.0.0, < 2.4.0	2.4.0
@clerk/astro	npm	>= 2.9.0, < 2.10.2	2.10.2
@clerk/express	npm	>= 1.6.0, < 1.7.4	1.7.4
@clerk/fastify	npm	>= 2.3.0, < 2.4.4	2.4.4
@clerk/nextjs	npm	>= 6.2.10, < 6.23.3	6.23.3
@clerk/nuxt	npm	>= 1.7.0, < 1.7.5	1.7.5
@clerk/react-router	npm	>= 1.5.0, < 1.6.4	1.6.4
@clerk/remix	npm	>= 4.8.0, < 4.8.5	4.8.5
@clerk/tanstack-react-start	npm	>= 0.16.0, < 0.18.3	0.18.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the verifyWebhook function within the @clerk/backend package. The function was responsible for verifying the authenticity of incoming webhooks from Clerk. The original implementation contained a critical logic flaw in its signature verification process. Instead of rejecting requests with invalid signatures, it did the opposite: it rejected requests with valid signatures and allowed those with invalid or no signatures to be processed. This would allow an attacker to bypass webhook authentication and send malicious or spoofed events to the application.\n\nThe patch addresses this by completely refactoring the verifyWebhook function. It removes the incorrect manual implementation and replaces it with the standardwebhooks library, which is the standard for webhook verification and is used by Svix (the underlying webhook provider for Clerk). This ensures that webhook signatures are verified correctly and that only authentic requests from Clerk are processed.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

7.5

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-53548: @clerk/backend Performs Insufficient Verification of Data Authenticity

Impact

Patches

Resolution

Workarounds

CVE-2025-53548:

7.5

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Technical Details

Basic Information

Basic Information

CVE-2025-53548: @clerk/backend Performs Insufficient Verification of Data Authenticity

Impact

Patches

Resolution

Workarounds

7.5

7.5

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI