The vulnerability in Clerk JavaScript SDKs involves improper checking of unusual or exceptional conditions (CWE-754) and insufficient authorization (CWE-863) in combined authorization predicates such as has() and auth.protect(). When these predicates combine reverification with role, permission, feature, or plan checks, or combine billing checks with role or permission checks, the functions may erroneously return true, granting access to users who do not meet all required conditions. This flaw exists in multiple Clerk SDK packages including @clerk/shared, @clerk/nextjs, and @clerk/backend. The vulnerability is fixed in versions 5.125.10 and 6.7.5 of @clerk/clerk-js.

An attacker with limited privileges might bypass combined authorization checks and perform actions that should be restricted, potentially leading to unauthorized access to gated features or operations. The CVSS 4.0 score of 7.6 (high severity) reflects the network attack vector, low attack complexity, and the requirement for privileges but no user interaction. There are no reports of active exploitation in the wild.

Upgrading to @clerk/clerk-js versions 5.125.10 or 6.7.5 or later fully addresses this vulnerability. Users of affected versions should apply these updates promptly. Since this is a client-side library, patching the dependency in applications is required. No vendor advisory explicitly states otherwise, so patching is recommended.