Cloudanix VulnDB

CVE-2025-48370

None

CVSS

—

EPSS

0.9%

Published

May 27, 2025

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A library used for user authentication allowed attackers to trick the system into calling the wrong internal function by sending specially crafted user IDs instead of normal ones.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Data Tampering
Component
Library
Class
Path Traversal
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The library functions getUserById, deleteUser, updateUserById, listFactors and deleteFactor did not enforce valid UUID format on user-supplied identifiers, allowing crafted values to alter the constructed API request path and invoke an unintended endpoint.

Why it matters to the business

Attackers may reach administrative or unintended API operations through user-controlled identifiers, increasing risk of unauthorized data access or modification in authentication workflows that rely on this library.

How an attack unfolds

An attacker supplies a non-UUID value containing path traversal sequences to one of the affected functions; the library embeds the value directly into the request URL without validation, causing the Supabase backend to route the call to a different API handler than intended.

How to fix it

Upgrade auth-js to version 2.70.0 or later; additionally enforce UUID format validation on all user-supplied identifiers before they reach these functions.

How to confirm the fix worked

Confirm the installed auth-js version is at least 2.70.0; perform targeted tests sending non-UUID values to the listed functions and verify that requests are rejected or normalized before reaching the network layer.

Typical attack path

  1. Identify an application endpoint or integration that invokes getUserById, deleteUser, updateUserById, listFactors or deleteFactor with attacker-controlled input.
  2. Craft an identifier containing path traversal characters instead of a valid UUID.
  3. Submit the malformed identifier to trigger an unintended backend API call.
  4. Observe or leverage the results of the incorrectly routed operation.

How to detect it

Search authentication or application logs for calls to getUserById, deleteUser, updateUserById, listFactors or deleteFactor that contain non-UUID values or path traversal sequences; inspect request URLs for unexpected path segments originating from these functions.

What your security team should do

  • Immediately upgrade all instances of auth-js to 2.70.0 or newer.
  • Add server-side UUID validation for every identifier passed to the affected functions.
  • Review audit logs for any recent calls that used non-UUID identifiers in authentication paths.
  • Prioritize the upgrade because the issue is public and the library is widely used in Supabase deployments.

The record

auth-js is an isomorphic Javascript library for Supabase Auth. Prior to version 2.70.0, the library functions getUserById, deleteUser, updateUserById, listFactors and deleteFactor did not require the user supplied values to be valid UUIDs. This could lead to a URL path traversal, resulting in the wrong API function being called. Implementations that follow security best practice and validate user controlled inputs, such as the userId are not affected by this. This issue has been patched in version 2.70.0.

Affected packages

Ecosystem Package Introduced Fixed
npm @supabase/auth-js 0 2.70.0

Related vulnerabilities