CVE-2025-48370 LOW

CVE-2025-48370: auth-js Vulnerable to Insecure Path Routing from Malformed User Input

Vendor Supabase
Product auth-js
Weakness CWE-287 · Improper authentication
Published May 27, 2025
Last update April 27, 2026
View on NVD All CVEs

CVSS base score

2.7/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U

What the vulnerability does

01Description

auth-js is an isomorphic Javascript library for Supabase Auth. Prior to version 2.70.0, the library functions getUserById, deleteUser, updateUserById, listFactors and deleteFactor did not require the user supplied values to be valid UUIDs. This could lead to a URL path traversal, resulting in the wrong API function being called. Implementations that follow security best practice and validate user controlled inputs, such as the userId are not affected by this. This issue has been patched in version 2.70.0.

Key dates

02Disclosure timeline

May 27, 2025 CVE published
April 27, 2026 Record updated