The Clerk JavaScript library contains a flaw where the has() or auth.protect() predicates can incorrectly return true when certain combined checks are performed, such as a rev‑verification check combined with a role, permission, feature, or plan check, or a billing check combined with a role or permission check. This behavior allows a gated action to proceed for a user who does not satisfy all required conditions, effectively bypassing authorization and enabling privilege escalation or unauthorized access to protected resources.

The vulnerability applies to a wide range of Clerk SDKs, including @clerk/shared, @clerk/nextjs, @clerk/backend, @clerk/expo, @clerk/express, @clerk/fastify, @clerk/hono, @clerk/nuxt, @clerk/react, @clerk/react‑router, @clerk/tanstack‑react‑start, @clerk/vue, and the core clerk:javascript package. All installations prior to the fixed releases of 5.125.10 (for the JavaScript SDK) or 6.7.5 (for the community SDK) are potentially vulnerable. No specific pre‑fix versions are listed, so any version older than the stated fixes should be assumed at risk.

The severity is high, with a CVSS score of 7.6, and the vulnerability is not recorded in the CISA KEV list. Exploitation requires only that the vulnerable code be executed in the application, usually through normal application flow. An attacker who can supply or influence the arguments to has() or auth.protect() can construct a combined predicate that the library mistakenly evaluates to true. The vulnerability poses a significant risk to any application using these combined checks, but no external network exploitation is required, which limits the attack surface to the application deployment itself.