Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe security advisory describes an authorization bypass vulnerability in Clerk's has() and auth.protect() functions when multiple authorization checks are combined. The advisory mentions that the fix is in the @clerk/shared package and specifically in the createCheckAuthorization function.
By analyzing the source code of the createCheckAuthorization function and the combine function it uses, I was able to identify the flaw in the logic. The original combine function would return true if at least one of the authorization checks passed, even if other checks failed. This is incorrect, as all requested checks should pass for the authorization to be granted.
The patch for this vulnerability corrects the logic of the combine function to ensure that all non-skipped checks pass. This confirms that the createCheckAuthorization function was the source of the vulnerability.
Therefore, the vulnerable function is createCheckAuthorization in packages/shared/src/authorization.ts.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @clerk/shared | npm | >= 3.0.0, <= 3.47.4 | 3.47.5 |
| @clerk/shared | npm | >= 4.0.0, <= 4.8.2 | 4.8.3 |
| @clerk/backend | npm | >= 2.0.0, <= 2.33.2 | 2.33.3 |
| @clerk/backend | npm | >= 3.0.0, <= 3.2.13 | 3.2.14 |
| @clerk/nextjs | npm | >= 6.0.0, <= 6.39.2 | 6.39.3 |
| @clerk/nextjs | npm | >= 7.0.0, <= 7.2.3 | 7.2.4 |
| @clerk/clerk-js | npm | >= 5.22.0, <= 5.125.9 | 5.125.10 |
| @clerk/clerk-js | npm | >= 6.0.0, <= 6.7.4 | 6.7.5 |
| @clerk/clerk-react | npm | >= 5.9.0, <= 5.61.5 | 5.61.6 |
| @clerk/react | npm | >= 6.0.0, <= 6.4.2 | 6.4.3 |
| @clerk/vue | npm | >= 1.0.0, <= 1.17.20 | 1.17.21 |
| @clerk/vue | npm | >= 2.0.0, <= 2.0.15 | 2.0.16 |
| @clerk/astro | npm | >= 2.0.0, <= 2.17.10 | 2.17.11 |
| @clerk/astro | npm | >= 3.0.0, <= 3.0.17 | 3.0.18 |
| @clerk/nuxt | npm | >= 1.0.0, <= 1.13.28 | 1.13.29 |
| @clerk/nuxt | npm | >= 2.0.0, <= 2.2.4 | 2.2.5 |
| @clerk/clerk-expo | npm | >= 2.2.11, <= 2.19.35 | 2.19.36 |
| @clerk/expo | npm | >= 3.0.0, <= 3.2.1 | 3.2.2 |
| @clerk/react-router | npm | >= 0.0.1, <= 2.4.12 | 2.4.13 |
| @clerk/react-router | npm | >= 3.0.0, <= 3.1.3 | 3.1.4 |
| @clerk/tanstack-react-start | npm | >= 0.0.1, <= 0.29.10 | 0.29.11 |
| @clerk/tanstack-react-start | npm | >= 1.0.0, <= 1.1.3 | 1.1.4 |
| @clerk/chrome-extension | npm | >= 1.3.5, <= 2.9.14 | 2.9.15 |
| @clerk/chrome-extension | npm | >= 3.0.0, <= 3.1.14 | 3.1.15 |
| @clerk/fastify | npm | >= 1.0.42, <= 2.6.30 | 2.6.31 |
| @clerk/fastify | npm | >= 3.0.0, <= 3.1.15 | 3.1.16 |
| @clerk/express | npm | >= 0.1.0, <= 1.7.78 | 1.7.79 |
| @clerk/express | npm | >= 2.0.0, <= 2.1.5 | 2.1.6 |
| @clerk/hono | npm | >= 0.0.2, <= 0.1.15 | 0.1.16 |
