CVE-2025-63700

CVE-2025-63700 · Clerk-js vulnerable to bypass of OAuth authentication flow by manipulating request at OTP verification stage

This page contains facts from public vulnerability sources. Check the original advisory before updating.

An issue was discovered in Clerk-js 5.88.0 allowing attackers to bypass the OAuth authentication flow by manipulating the request at the OTP verification stage.

CVSS 8.7 · High

Published: 2025-11-20T21:30:32Z
Updated: 2025-11-21T01:27:48.888394Z

Stack: node

Affected products and versions

@clerk/clerk-js npm
Affected ranges
- SEMVER: ≤ 5.88.0
No fix published

Original sources

https://nvd.nist.gov/vuln/detail/CVE-2025-63700
https://clerk.com
https://github.com/clerk/javascript
https://github.com/itsnishat08/CVE-2025-63700
https://osv.dev/vulnerability/GHSA-3mm3-wfpv-q85g

Check your server →

CVE-2025-63700 · Clerk-js vulnerable to bypass of OAuth authentication flow by manipulating request at OTP verification stage

Affected products and versions

@clerk/clerk-js npm

Original sources