Tag
high
advisory
Clerk Authorization Bypass Vulnerability
2 rules 1 TTPClerk has an authorization bypass vulnerability in multiple packages where the `has()` and `auth.protect()` predicates can incorrectly return true, potentially allowing unauthorized actions.
@clerk/shared +16
authorization
bypass
clerk
cve-2026-42349
2r
1t
high
advisory
Clerk SSRF Vulnerability in frontendApiProxy Allows Secret Key Leakage
2 rules 1 TTPA server-side request forgery (SSRF) vulnerability exists in the `clerkFrontendApiProxy` function of the `@clerk/backend` package, allowing an unauthenticated attacker to send the application's `Clerk-Secret-Key` to an attacker-controlled server.
ssrf
vulnerability
clerk
cloud
2r
1t