CVE-2025-48370
auth-js Vulnerable to Insecure Path Routing from Malformed User Input
Impact
### Impact The library functions `getUserById`, `deleteUser`, `updateUserById`, `listFactors` and `deleteFactor` did not require the user supplied values to be valid UUIDs. This could lead to a URL path traversal, resulting in the wrong API function being called. Implementations that follow security best practice and validate user controlled inputs, such as the `userId` are not affected by this. ### Patches Strict value checks have been added to all affected functions. These functions now require that the `userId` and `factorId` parameters MUST be valid UUID (v4). **Patched version:** >= 2.69.1 ### Workarounds Implementations that follow security best practice and validate user controlled inputs, such as the `userId` are not affected by this. It is recommended that users of the auth-js library always follow security best practice and validate all inputs, before passing these to other functions or libraries. ### References https://github.com/supabase/auth-js/pull/1063
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @supabase/auth-js | <= 2.69.1 | 2.70.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/supabase/auth-js/commit/1bcb76e479e51cd9bca2d7732d0bf3199e07a693
- https://github.com/supabase/auth-js/pull/1063
- https://github.com/supabase/auth-js/security/advisories/GHSA-8r88-6cj9-9fh5
- https://github.com/advisories/GHSA-8r88-6cj9-9fh5
- https://nvd.nist.gov/vuln/detail/CVE-2025-48370