Clerk JavaScript’s clerkFrontendApiProxy feature is susceptible to Server-Side Request Forgery, allowing an unauthenticated attacker to craft a request path that causes the proxy to forward the application’s Clerk‑Secret‑Key to an external host. The vulnerability, identified as CWE‑918, results in a confidentiality breach that could enable the attacker to perform further malicious actions or gain unauthorized access to protected resources.

The issue affects Clerk’s official JavaScript SDK, specifically @clerk/hono versions 0.1.0 to 0.1.4, @clerk/express versions 2.0.0 to 2.0.6, @clerk/backend versions 3.0.0 to 3.2.2, and @clerk/fastify versions 3.1.0 to 3.1.4. Updated releases are available that contain the fix.

With a CVSS score of 7.4 the vulnerability is considered high severity. While EPSS data is unavailable and it is not listed in the CISA KEV catalog, the vulnerability can be exploited without authentication, provided the attacker can send a crafted request to the application. The attack path involves supplying a malicious path to the clerkFrontendApiProxy endpoint, which will then forward the secret key to the attacker-controlled server, potentially exposing credentials used by the application.