The vulnerability in Clerk JavaScript SDKs arises from improper validation logic in authorization predicates like has() and auth.protect(). When these functions combine reverification checks with roles, permissions, features, or plans, or combine billing checks with roles or permissions, they may erroneously grant access by returning true when they should not. This flaw can lead to unauthorized users bypassing intended access controls. The issue is tracked as CWE-754 (Improper Check for Unusual or Exceptional Conditions) and CWE-863 (Incorrect Authorization). It affects versions >= 5.22.0 and < 5.125.10, and >= 6.0.0 and < 6.7.5 of the Clerk JavaScript SDK. Fixed versions are 5.125.10 and 6.7.5.

The vulnerability allows users who do not meet the full set of authorization conditions to perform actions that should be gated, potentially leading to unauthorized access or privilege escalation within applications using affected Clerk JavaScript SDK versions. The CVSS 4.0 score of 7.6 reflects a high severity with network attack vector, low attack complexity, partial privileges required, no user interaction, and high impact on confidentiality and integrity.

A fix is available and users should upgrade to @clerk/clerk-js versions 5.125.10 or 6.7.5 or later. Since this is a client-side SDK vulnerability, applying the official patch is the recommended remediation. Patch status is confirmed by the vendor advisory indicating these fixed versions. No additional vendor advisory states that no action is required or that the issue is mitigated otherwise.