CVE-2025-48370: CWE-287: Improper Authentication in supabase auth-js
auth-js is an isomorphic Javascript library for Supabase Auth. Prior to version 2.70.0, the library functions getUserById, deleteUser, updateUserById, listFactors and deleteFactor did not require the user supplied values to be valid UUIDs. This could lead to a URL path traversal, resulting in the wrong API function being called. Implementations that follow security best practice and validate user controlled inputs, such as the userId are not affected by this. This issue has been patched in version 2.70.0.
AI Analysis
Technical Summary
CVE-2025-48370 affects the Supabase auth-js library versions before 2.70.0. The functions getUserById, deleteUser, updateUserById, listFactors, and deleteFactor did not validate that user-supplied values were valid UUIDs. This improper validation could result in URL path traversal, causing the wrong API function to be invoked. Implementations that validate user inputs such as userId are not affected. The vulnerability is classified under CWE-287 (Improper Authentication) and CWE-22 (Path Traversal). It has a low CVSS 4.0 score of 2.7 and was patched in version 2.70.0.
Potential Impact
The vulnerability could allow an attacker to cause the library to call unintended API functions by supplying invalid UUID inputs, potentially bypassing intended authentication checks. However, the impact is limited as proper input validation mitigates the issue, and the CVSS score is low. There are no known exploits in the wild.
Mitigation Recommendations
Upgrade the auth-js library to version 2.70.0 or later, where this issue has been patched. Implementations that already validate user-supplied UUID inputs are not affected and do not require additional action.
CVE-2025-48370: CWE-287: Improper Authentication in supabase auth-js
Description
auth-js is an isomorphic Javascript library for Supabase Auth. Prior to version 2.70.0, the library functions getUserById, deleteUser, updateUserById, listFactors and deleteFactor did not require the user supplied values to be valid UUIDs. This could lead to a URL path traversal, resulting in the wrong API function being called. Implementations that follow security best practice and validate user controlled inputs, such as the userId are not affected by this. This issue has been patched in version 2.70.0.
CVSS v4.0
Score 2.7low
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2025-48370 affects the Supabase auth-js library versions before 2.70.0. The functions getUserById, deleteUser, updateUserById, listFactors, and deleteFactor did not validate that user-supplied values were valid UUIDs. This improper validation could result in URL path traversal, causing the wrong API function to be invoked. Implementations that validate user inputs such as userId are not affected. The vulnerability is classified under CWE-287 (Improper Authentication) and CWE-22 (Path Traversal). It has a low CVSS 4.0 score of 2.7 and was patched in version 2.70.0.
Potential Impact
The vulnerability could allow an attacker to cause the library to call unintended API functions by supplying invalid UUID inputs, potentially bypassing intended authentication checks. However, the impact is limited as proper input validation mitigates the issue, and the CVSS score is low. There are no known exploits in the wild.
Mitigation Recommendations
Upgrade the auth-js library to version 2.70.0 or later, where this issue has been patched. Implementations that already validate user-supplied UUID inputs are not affected and do not require additional action.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2025-05-19T15:46:00.395Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6835dda5182aa0cae2186689
Added to database: 05/27/2025, 15:43:33 UTC
Last enriched: 07/30/2026, 01:00:20 UTC
Last updated: 09/10/2026, 19:36:50 UTC
Views: 219
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.