GitHub Advisoryadvisory · npm

GHSA-3mm3-wfpv-q85g Clerk-js vulnerable to bypass of OAuth authentication flow by manipulating request at OTP verification stage

MEDIUM Published 2025-11-20 Modified 2025-11-21 Official page ↗
Aliases
CVE-2025-63700
Ecosystem
npm
Packages
@clerk/clerk-js
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-290, CWE-639
Reviewed
2025-11-21

Affected packages

• npm @clerk/clerk-js: <= 5.88.0 (no fix yet)

Description

An issue was discovered in Clerk-js 5.88.0 allowing attackers to bypass the OAuth authentication flow by manipulating the request at the OTP verification stage.

Related

Alias · not in database (1)

Weakness · CWE (2)

  • CWE-290 Authentication Bypass by Spoofing weakness
  • CWE-639 Authorization Bypass Through User-Controlled Key weakness

References