itsnishat08/cve-2025-63700Technical documentation and proof-of-concept for CVE-2025-63700, an OAuth authentication bypass vulnerability in Clerk-js 5.88.0 allowing unauthorized account access via request manipulation during OTP verification.
@clerk/clerk-js)A vulnerability was discovered in Clerk-js (@clerk/clerk-js) 5.88.0 where an attacker could bypass the OAuth authentication flow by manipulating the request at the OTP verification stage.
This issue could allow unauthorized account access under specific conditions.
During the sign-in flow, Clerk uses different authentication strategies such as email-based OTP and TOTP (Authenticator App). A flaw in the verification step allowed the request to be altered from one authentication strategy to another, which resulted in improper validation of the OAuth login sequence. Because the backend did not fully re-validate the authentication stage, an attacker could successfully complete the login flow without providing the correct verification code.
If successfully exploited, an attacker could: