{"action":"Upgrade @clerk/nextjs to 4.29.3 or later.","affected":[{"fixed":"4.29.3","introduced":"4.7.0"}],"component":"@clerk/nextjs","cve_ids":["CVE-2024-22206"],"ecosystem":"npm","epss":0.00682,"exploited":false,"fixed_versions":["4.29.3"],"ghsa_id":"GHSA-q6w5-jg5q-47vg","id":"tcs_01M5KG5FM6C29TCFQF4KXX5CMT","modified_at":"2026-09-10T03:50:05.070390984Z","published_at":"2024-01-12T20:27:29Z","references":["https://osv.dev/vulnerability/GHSA-q6w5-jg5q-47vg","https://github.com/clerk/javascript/security/advisories/GHSA-q6w5-jg5q-47vg","https://nvd.nist.gov/vuln/detail/CVE-2024-22206","https://clerk.com/changelog/2024-01-12","https://github.com/clerk/javascript","https://github.com/clerk/javascript/releases/tag/%40clerk%2Fnextjs%404.29.3"],"severity":{"label":"critical","score":9},"sources":[{"source":"osv","source_id":"GHSA-q6w5-jg5q-47vg","url":"https://osv.dev/vulnerability/GHSA-q6w5-jg5q-47vg"}],"summary":"@clerk/nextjs auth() and getAuth() methods vulnerable to insecure direct object reference (IDOR)"}