medium7.5
CVE-2025-63700
Clerk-js vulnerable to bypass of OAuth authentication flow by manipulating request at OTP verification stage
Impact
An issue was discovered in Clerk-js 5.88.0 allowing attackers to bypass the OAuth authentication flow by manipulating the request at the OTP verification stage.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @clerk/clerk-js | <= 5.88.0 | none recorded |