AIKIDO-2026-395995

TL;DR

@clerk/express provides authentication middleware and helpers for Express applications. The middleware and helpers decide that authentication already ran by checking only for the presence of a req.auth property, a name also used by other authentication libraries such as express-jwt, Passport, and express-openid-connect. When one of those libraries runs first and sets req.auth, clerkMiddleware() and requireAuth() skip Clerk authentication and getAuth() returns the other library's unverified value, so a request can pass authentication checks without a valid Clerk session. The fix brands the handler Clerk installs and trusts only that branded handler, overwriting any foreign req.auth.