关键信息 漏洞信息 CVE编号: CVE-2025-63700 漏洞类型: OAuth Authentication Bypass in Clerk-js 5.88.0 影响: OAuth Authentication Bypass 影响的产品 厂商: Clerk Inc. (clerk.dev / clerk.com) 产品: Clerk-js (@clerk/clerk-js) 受影响版本: 5.88.0 漏洞描述 A vulnerability was discovered in Clerk-js (@clerk/clerk-js) 5.88.0 where an attacker could bypass the OAuth authentication flow by manipulating the request at the OTP verification stage. This issue could allow unauthorized account access under specific conditions. 漏洞细节 During the sign-in flow, Clerk uses different authentication strategies such as email-based OTP and TOTP (Authenticator App). A flaw in the verification step allowed the request to be altered from one authentication strategy to another, which resulted in improper validation of the OAuth login sequence. Because the backend did not fully re-validate the authentication stage, an attacker could successfully complete the login flow without providing the correct verification code. 影响 If successfully exploited, an attacker could: - Bypass OAuth verification - Gain unauthorized access to a target account 参考链接 https://nvd.nist.gov/vuln/detail/CVE-2025-63700 https://www.cve.org/CVERecord?id=CVE-2025-63700