UpHeron
All vulnerabilities

npm

CVE-2024-22206

@clerk/nextjs auth() and getAuth() methods vulnerable to insecure direct object reference (IDOR)

Severity
Critical 9.0
Published
12 Jan 2024
Last changed
10 Sept 2026
Added to UpHeron
14 Oct 2026
Fixed in
4.29.3
Also known as
GHSA-q6w5-jg5q-47vg
Sources
OSV.dev and GitHub

Affected software

SoftwareAffected versions
@clerk/nextjsnpm · osv:npm:@clerk/nextjs
  • From 4.7.0 before 4.29.3

References