CVE-2024-22206: falha crítica em clerk javascript
@clerk/nextjs auth() and getAuth() methods vulnerable to insecure direct object reference (IDOR)
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.1epss 0.7%
Clerk helps developers build user management. Unauthorized access or privilege escalation due to a logic flaw in auth() in the App Router or getAuth() in the Pages Router. This vulnerability was patched in version 4.29.3.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Produtos afetados
clerk · javascriptCVEs relacionadas — clerk javascript
No mesmo produto, das mais perigosas para as menos.
CVE-2026-34076HIGHClerk JavaScript: SSRF in the opt-in clerkFrontendApiProxy feature may leak secret keys to unintended hostEPSS 0.3%CVE-2026-42349HIGHClerk: Authorization bypass when combining organization, billing, or reverification checksEPSS 0.2%CVE-2025-53548HIGH@clerk/backend Performs Insufficient Verification of Data AuthenticityEPSS 0.2%