Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS1xNnc1LWpnNXEtNDd2Z84AA4bF

@clerk/nextjs auth() and getAuth() methods vulnerable to insecure direct object reference (IDOR)

Impact

Unauthorized access or privilege escalation due to a logic flaw in auth() in the App Router or getAuth() in the Pages Router.

Affected Versions

All applications that that use @clerk/nextjs versions in the range of >= 4.7.0,< 4.29.3 in a Next.js backend to authenticate API Routes, App Router, or Route handlers. Specifically, those that call auth() in the App Router or getAuth() in the Pages Router. Only the @clerk/nextjs SDK is impacted. Other SDKs, including other Javascript-based SDKs, are not impacted.

Patches

Fix included in @clerk/[email protected].

References

Permalink: https://github.com/advisories/GHSA-q6w5-jg5q-47vg
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1xNnc1LWpnNXEtNDd2Z84AA4bF
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: 4 months ago
Updated: 4 months ago


CVSS Score: 9.1
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Identifiers: GHSA-q6w5-jg5q-47vg, CVE-2024-22206
References: Repository: https://github.com/clerk/javascript
Blast Radius: 32.8

Affected Packages

npm:@clerk/nextjs
Dependent packages: 10
Dependent repositories: 4,066
Downloads: 449,921 last month
Affected Version Ranges: >= 4.7.0, < 4.29.3
Fixed in: 4.29.3
All affected versions: 4.7.0, 4.7.1, 4.7.2, 4.7.3, 4.7.4, 4.7.5, 4.7.6, 4.7.7, 4.7.9, 4.7.10, 4.8.0, 4.8.1, 4.8.2, 4.9.0, 4.9.1, 4.10.0, 4.10.1, 4.10.2, 4.11.0, 4.11.1, 4.11.2, 4.11.3, 4.11.4, 4.11.5, 4.11.6, 4.11.7, 4.11.9, 4.11.10, 4.11.11, 4.11.12, 4.11.13, 4.11.14, 4.13.0, 4.14.0, 4.14.1, 4.14.2, 4.15.0, 4.16.0, 4.16.1, 4.16.2, 4.16.3, 4.16.4, 4.17.0, 4.17.1, 4.17.2, 4.17.3, 4.17.4, 4.18.0, 4.18.1, 4.18.2, 4.18.3, 4.18.4, 4.18.5, 4.19.0, 4.19.1, 4.20.0, 4.21.0, 4.21.1, 4.21.2, 4.21.3, 4.21.4, 4.21.5, 4.21.6, 4.21.7, 4.21.8, 4.21.9, 4.21.10, 4.21.11, 4.21.12, 4.21.13, 4.21.14, 4.21.15, 4.22.0, 4.22.1, 4.23.0, 4.23.1, 4.23.2, 4.23.3, 4.23.4, 4.23.5, 4.24.0, 4.24.1, 4.24.2, 4.25.0, 4.25.1, 4.25.2, 4.25.3, 4.25.4, 4.25.5, 4.25.6, 4.25.7, 4.26.0, 4.26.1, 4.26.2, 4.27.0, 4.27.1, 4.27.2, 4.27.3, 4.27.4, 4.27.5, 4.27.6, 4.27.7, 4.28.0, 4.28.1, 4.29.0, 4.29.1, 4.29.2
All unaffected versions: 1.0.0, 1.0.1, 1.1.0, 1.2.0, 1.2.1, 1.3.0, 1.4.0, 1.4.1, 1.4.2, 1.5.0, 1.5.1, 1.5.2, 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.0.6, 2.0.7, 2.0.8, 2.1.0, 2.2.0, 2.2.1, 2.2.2, 2.2.3, 2.3.0, 2.4.0, 2.4.1, 2.4.2, 2.4.3, 2.4.4, 2.5.0, 2.6.0, 2.7.0, 2.8.0, 2.9.0, 2.9.1, 2.10.0, 2.10.1, 2.11.0, 2.11.1, 2.11.4, 2.11.5, 2.11.6, 2.11.7, 2.11.8, 2.11.9, 2.11.10, 2.11.12, 2.11.13, 2.11.14, 2.11.15, 2.11.17, 2.11.18, 3.2.2, 3.2.3, 3.2.4, 3.3.0, 3.3.1, 3.3.2, 3.3.3, 3.3.4, 3.3.5, 3.3.6, 3.3.7, 3.4.0, 3.4.1, 3.5.0, 3.6.0, 3.6.1, 3.6.3, 3.6.4, 3.6.5, 3.6.6, 3.6.7, 3.6.8, 3.6.10, 3.6.11, 3.6.12, 3.6.13, 3.7.0, 3.7.1, 3.8.0, 3.8.1, 3.8.2, 3.8.3, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.5, 4.1.0, 4.1.1, 4.1.2, 4.1.3, 4.1.4, 4.1.5, 4.1.6, 4.1.7, 4.2.0, 4.2.1, 4.3.0, 4.3.2, 4.5.0, 4.5.1, 4.5.2, 4.5.3, 4.5.4, 4.5.5, 4.5.6, 4.5.7, 4.5.8, 4.6.0, 4.6.1, 4.6.2, 4.6.4, 4.6.5, 4.6.6, 4.6.7, 4.6.8, 4.6.9, 4.6.11, 4.6.12, 4.6.13, 4.6.14, 4.6.15, 4.6.16, 4.6.17, 4.6.18, 4.29.3, 4.29.4, 4.29.5, 4.29.6, 4.29.7, 4.29.8, 4.29.9, 4.29.10, 4.29.11, 4.29.12, 4.30.0, 4.30.1, 5.0.0, 5.0.1, 5.0.2, 5.0.3