CVE-2025-48370CWE-22CWE-287

auth-js Vulnerable to Insecure Path Routing from Malformed User Input

Low · published May 27, 2025

CVSS v4.0
2.7
EPSS
1%
Percentile
59.4
In the wild
Unconfirmed
What it is

auth-js is an isomorphic Javascript library for Supabase Auth. Prior to version 2.70.0, the library functions getUserById, deleteUser, updateUserById, listFactors and deleteFactor did not require the user supplied values to be valid UUIDs. This could lead to a URL path traversal, resulting in the wrong API function being called. Implementations that follow security best practice and validate user controlled inputs, such as the userId are not affected by this. This issue has been patched in version 2.70.0.

The record
Technical detail
CVSS v4.0
2.7 · LOW
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U
EPSS
0.00902 · 59.4th percentile
Weaknesses
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'); CWE-287 · Improper Authentication
Published
2025-05-27T15:27Z
EPSS history
Timeline
  • 27 MAY 15:27Z
    auth-js Vulnerable to Insecure Path Routing from Malformed User Input
    cvelistv5