The auth-js library versions prior to 2.70.0 contain a vulnerability where certain functions do not validate that user-supplied IDs are valid UUIDs. This can lead to URL path traversal, causing unintended API functions to be called. The issue is fixed in version 2.70.0 by enforcing strict UUID v4 validation on userId and factorId parameters. Implementations that already validate user inputs are not affected.