@clerk/shared@4.3.3-canary.v20260323213541

@clerk/shared is an Internal package utils used by the Clerk SDKs

Affected versions of this package are vulnerable to Incorrect Authorization through the createProtect and createCheckAuthorization functions. An attacker can gain access to protected pages or handlers by supplying a single auth.protect() or has() call that mixes authorization criteria with redirect/token options, or by combining multiple authorization dimensions where one should deny but is treated as indeterminate.

The vulnerable logic in createProtect can bypass role, permission, feature, plan, or re-verification checks when the same object also includes unauthenticatedUrl, unauthorizedUrl, or token, allowing authenticated callers through without the intended authorization test. In createCheckAuthorization, combined checks across organization, billing, and reverification can return success when one dimension passes, and another lacks valid session data, allowing users to reach admin-only or otherwise restricted functionality and bypass access controls.

Note: From the project maintainers: If you pin @clerk/clerk-js directly, upgrade it to the patched version. Most apps load @clerk/clerk-js from Clerk's CDN through their framework package and will receive the fix automatically, with no upgrade step required.

Upgrade @clerk/shared to version 3.47.5, 4.8.3 or higher.