CVE-2024-22206
@clerk/nextjs auth() and getAuth() methods vulnerable to insecure direct object reference (IDOR)
Résumé
@clerk/nextjs auth() and getAuth() methods vulnerable to insecure direct object reference (IDOR)
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Clerk helps developers build user management. Unauthorized access or privilege escalation due to a logic flaw in auth() in the App Router or getAuth() in the Pages Router. This vulnerability was patched in version 4.29.3.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- web clerk.com
- web github.com