A critical vulnerability in Clerk SDKs allows unauthenticated attackers to bypass webhook signature verification, potentially leading to unauthorized data processing.

The vulnerability exists in the verifyWebhook() helper function, which fails to correctly validate the authenticity of incoming webhook events. This flaw allows an unauthenticated attacker to inject malicious or spoofed event data into an application, as the system does not properly verify the cryptographic signature.

The inability to verify webhook authenticity compromises the integrity of user management workflows and event-driven automation. An attacker could trigger unauthorized actions, such as bypassing security workflows or injecting false state changes, which could lead to significant data corruption or unauthorized access. With a CVSS score of 7.5, this high-severity flaw represents a substantial risk to application logic and trust.

Immediate Action: Upgrade all affected @clerk packages to the versions specified in the vendor advisory (e.g., @clerk/backend to 2.4.0 or higher).

Proactive Monitoring: Review application audit logs for unexpected webhook event triggers or anomalous data modifications that coincide with the deployment of Clerk webhooks.

Compensating Controls: Implement secondary validation logic for sensitive webhook-driven operations and ensure that webhooks are restricted to expected IP ranges if the provider supports such configurations.

Public Exploit Available: No confirmed public exploit exists.

Given the potential for unauthorized data manipulation via webhook spoofing, organizations must prioritize updating their Clerk SDKs. Failure to apply these updates leaves the application susceptible to event injection attacks that can undermine critical user management processes. Verify the specific framework packages in use against the provided fixed version list and deploy the updates immediately.