CVE-2025-63700
High · 7.5Clerk-js vulnerable to bypass of OAuth authentication flow by manipulating request at OTP verification stage
CVSS
7.5
EPSS
—
Published
Nov 20, 2025
CISA due date
—
The record
An issue was discovered in Clerk-js 5.88.0 allowing attackers to bypass the OAuth authentication flow by manipulating the request at the OTP verification stage.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @clerk/clerk-js | 0 | No fix |
Related vulnerabilities
- GHSA-3mm3-wfpv-q85g Clerk-js vulnerable to bypass of OAuth authentication flow by manipulating request at OTP… Same vulnerability
- CVE-2026-42349 Clerk JavaScript is the official JavaScript repository for Clerk authentication. Also affects @clerk/clerk-js
- GHSA-w24r-5266-9c3c Clerk has an authorization bypass when combining organization, billing, or reverification… Also affects @clerk/clerk-js
- CVE-2026-114640 Traefik from v3.7.0 before v3.7.14 contains an authentication bypass vulnerability in its… CWE-290
- CVE-2026-90711 proxy-addr is a Node.js module that determines a request's client address behind trusted… CWE-290
- CVE-2026-66674 Unauthenticated Bypass Vulnerability in Simple Cloudflare Turnstile <= 1.42.1 versions. CWE-290
- CVE-2026-82563 An attacker could impersonate the camera and place themselves in a man-in-the-middle or… CWE-290
- CVE-2026-82530 IP2Location Country Blocker plugin for WordPress before 2.45.0 contains an access control… CWE-290