clerk
Security Risk Profile
55
/100
mediumSecurity Risk Score
Comprehensive risk assessment based on 5 vulnerabilities, EPSS scores, exploitation status, and remediation availability.
📅 Data spans from December 5, 2022 to present
5
Total CVEs
5
Critical+High
0
Exploited
2
Unpatched
Threat Assessment
Avg CVSS
8
Base severity
Avg EPSS
0%
Exploit probability
Unpatched
2
Critical/High
Risk Level
55/100
medium
Severity Distribution
Critical
1High
4Medium
0Low
0Exploit Likelihood
>50% chance
020-50%
05-20%
0<5%
1Age Distribution
Common Weaknesses (CWE)
No CWE data available
Most Affected Products
1. npm/@clerk/nextjs4
2. npm/@clerk/express3
3. npm/@clerk/fastify3
4. npm/@clerk/tanstack-react-start3
5. npm/@clerk/react-router3
Recent Vulnerabilities
See more →CVE-2026-42349
CVSS 7.6high
Clerk: Authorization bypass when combining organization, billing, or reverification checks
4/30/2026
CVE-2025-63700
CVSS 7.5high
11/20/2025🔧 No Patch
CVE-2025-53548
CVSS 7.5high
@clerk/backend Performs Insufficient Verification of Data Authenticity
7/9/2025
CVE-2024-22206
CVSS 9.8EPSS 0%critical
@clerk/nextjs auth() and getAuth() methods vulnerable to insecure direct object reference (IDOR)
1/12/2024
CVE-2022-3907
CVSS 7.5high
Clerk < 4.0.0 - Authentication Bypass and API Keys Disclosure
12/5/2022🔧 No Patch
Monitor clerk in Real-Time
Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.