Riskcovery

CVE-2025-48370

auth-js Vulnerable to Insecure Path Routing from Malformed User Input

State
Published
Severity
2.7 Low
Published
May 27, 2025
Updated
Jul 27, 2026
Reserved
May 19, 2025

Read the record on cve.org

Description

auth-js is an isomorphic Javascript library for Supabase Auth. Prior to version 2.70.0, the library functions getUserById, deleteUser, updateUserById, listFactors and deleteFactor did not require the user supplied values to be valid UUIDs. This could lead to a URL path traversal, resulting in the wrong API function being called. Implementations that follow security best practice and validate user controlled inputs, such as the userId are not affected by this. This issue has been patched in version 2.70.0.

Scores

CVSSScoreVectorSource
4.02.7 LowCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:UGitHub_M

Weaknesses

  • CWE-287 Improper Authentication
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected Products

ProductVersions
auth-jssupabase
  • < 2.70.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.