update

src/posts/clerk-nextjs-vulnerability.md

@@ -150,7 +150,7 @@ What get's logged?
 User ID: pwned
 ```
 
-Bingo. Looking through the source code, it looks like the middleware validates the `Authorization` header first and then the cookie, while `parseJwt()` does it in the opposite order. This is a big yikes. A very big one. You could essentially impersonate any user with this as long as you know their user ID, which could be public information.
+Bingo. Looking through the source code, it looks like the middleware validates the `Authorization` header first and then the cookie, while `parseJwt()` does it in the opposite order. This is a big yikes. A very big one. You could essentially impersonate any user with this as long as you know their user ID, which could be public information, or change roles to escalate your privilege.
 
 If you'd like to see the exploit in action, I have a [reproduction](https://github.com/pilcrowOnPaper/clerk-nextjs-vulnerability) available on GitHub.