Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2025-53548

@clerk/backend Performs Insufficient Verification of Data Authenticity

Description

Clerk helps developers build user management. Applications that use the verifyWebhook() helper to verify incoming Clerk webhooks are susceptible to accepting improperly signed webhook events. The issue was resolved in @clerk/backend 2.4.0.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

clerk javascript

  • < 2.4.0affected

References