GitHub Advisoryadvisory · npm

GHSA-8r88-6cj9-9fh5 auth-js Vulnerable to Insecure Path Routing from Malformed User Input

LOW Published 2025-05-27 Modified 2026-05-05 Official page ↗
Aliases
CVE-2025-48370
Ecosystem
npm
Packages
@supabase/auth-js
Severity
Low
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U
Weaknesses
CWE-22
Reviewed
2025-05-27

Affected packages

• npm @supabase/auth-js: < 2.70.0 → fixed in 2.70.0

Description

Impact The library functions `getUserById`, `deleteUser`, `updateUserById`, `listFactors` and `deleteFactor` did not require the user supplied values to be valid UUIDs. This could lead to a URL path traversal, resulting in the wrong API function being called. Implementations that follow security best practice and validate user controlled inputs, such as the `userId` are not affected by this. Patches Strict value checks have been added to all affected functions. These functions now require that the `userId` and `factorId` parameters MUST be valid UUID (v4). Patched version: >= 2.69.1 Workarounds Implementations that follow security best practice and validate user controlled inputs, such as the `userId` are not affected by this. It is recommended that users of the auth-js library always follow security best practice and validate all inputs, before passing these to other functions or libraries. References https://github.com/supabase/auth-js/pull/1063

Related

Alias · CVE (1)

  • CVE-2025-48370 auth-js is an isomorphic Javascript library for Supabase Auth. vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References