Executive brief
Clerk-js is a JavaScript library providing authentication and user management for web applications. A vulnerability in version 5.88.0 allows attackers to bypass OAuth login verification by manipulating requests at the OTP validation stage, potentially gaining unauthorized access to user accounts without providing proper credentials.
Technical details
The vulnerability is an authentication bypass (CWE-290, CWE-639) in the OAuth sign-in flow of Clerk-js 5.88.0. During sign-in, users can choose between email-based OTP and TOTP verification methods. A flaw in the verification step allows attackers to manipulate the request to switch authentication strategies mid-flow, and the backend does not fully re-validate the authentication stage before completing login. This enables an attacker to complete the login sequence without providing the correct verification code. The vulnerability requires network access with no authentication or user interaction preconditions. An attacker can gain unauthorized account access if the backend validation is insufficient. Fix/patch status was not explicitly stated in the advisory.
Affected products
- Clerk Inc. @clerk/clerk-js 5.88.0 and all prior versions
Timeline
- 2025-11-20: disclosed: Vulnerability disclosed via GitHub Security Advisory GHSA-3mm3-wfpv-q85g
- 2025-11-20: other: CVE-2025-63700 published