Packages / @clerk/clerk-js / Security

ModerateVulnerabilityGHSA-3mm3-wfpv-q85gCVE-2025-63700Published 20 Nov 2025

Clerk-js vulnerable to bypass of OAuth authentication flow by manipulating request at OTP verification stage

Affected releases · @clerk/clerk-js

  • 5.x5.0.0 – 5.88.0Fixed in 5.89.0
  • 4.x and older0.0.1 – 4.73.14No fix, no longer updated

On 5.x, the newest line:

npm install @clerk/clerk-js@5.89.0
6.x

  1. Not affected

    6.0.0 – 6.40.0

    86 releases, latest

5.x

  1. Affected

    5.0.0 – 5.88.0

    186 releases

  2. Fixed

    5.89.0 – 5.128.1

    71 releases

4.x

  1. Affected

    4.0.0 – 4.73.14

    184 releases

3.x

  1. Affected

    3.2.0 – 3.17.0

    31 releases

2.x

  1. Affected

    2.0.0 – 2.17.7

    57 releases

1.x

  1. Affected

    1.0.0 – 1.35.1

    74 releases

0.x

  1. Affected

    0.0.1

    1 release

690 stable releases of @clerk/clerk-js, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for @clerk/clerk-js. It is read in your browser and sent nowhere.

What happens

An issue was discovered in Clerk-js 5.88.0 allowing attackers to bypass the OAuth authentication flow by manipulating the request at the OTP verification stage.