Is CVE-2025-63700 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-63700 being exploited in the wild.

How severe is CVE-2025-63700?

Low severity, with a CVSS score of 3.1, published 20 November 2025.

Which products and versions are affected?

Clerk-Js 5.88.0; @clerk/clerk-js (npm) SEMVER:introduced=0,last_affected=5.88.0.

Is there a fix for CVE-2025-63700?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-63700 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-63700?

Check whether you run Clerk-Js or @clerk/clerk-js (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-63700: Clerk-js authentication bypass at OTP verification

CVE-2025-63700 · Severity: low · CVSS 3.1 · Published 2025-11-20

Clerk-js is a JavaScript library providing authentication and user management for web applications. A vulnerability in version 5.88.0 allows attackers to bypass OAuth login verification by manipulating requests at the OTP validation stage, potentially gaining unauthorized access to user accounts without providing proper credentials.

Vendors: Clerk, npm.

Quick answers

Is CVE-2025-63700 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-63700 being exploited in the wild.
How severe is CVE-2025-63700?: Low severity, with a CVSS score of 3.1, published 20 November 2025.
Which products and versions are affected?: Clerk-Js 5.88.0; @clerk/clerk-js (npm) SEMVER:introduced=0,last_affected=5.88.0.
Is there a fix for CVE-2025-63700?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-63700 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-63700?: Check whether you run Clerk-Js or @clerk/clerk-js (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authentication bypass (CWE-290, CWE-639) in the OAuth sign-in flow of Clerk-js 5.88.0. During sign-in, users can choose between email-based OTP and TOTP verification methods. A flaw in the verification step allows attackers to manipulate the request to switch authentication strategies mid-flow, and the backend does not fully re-validate the authentication stage before completing login. This enables an attacker to complete the login sequence without providing the correct verification code. The vulnerability requires network access with no authentication or user interaction preconditions. An attacker can gain unauthorized account access if the backend validation is insufficient. Fix/patch status was not explicitly stated in the advisory.

Affected products

Clerk Inc. @clerk/clerk-js 5.88.0 and all prior versions

Identifiers

CVE-2025-63700
GHSA-3mm3-wfpv-q85g

Timeline

2025-11-20: disclosed: Vulnerability disclosed via GitHub Security Advisory GHSA-3mm3-wfpv-q85g
2025-11-20: other: CVE-2025-63700 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.