auth-js Vulnerable to Insecure Path Routing from Malformed User Input

Description

The library functions getUserById, deleteUser, updateUserById, listFactors and deleteFactor did not require the user supplied values to be valid UUIDs. This could lead to a URL path traversal, resulting in the wrong API function being called.

Recommendation

Update the @supabase/auth-js package to the latest compatible version. Followings are version details:

• Affected version(s): <= 2.69.1
• Patched version(s): 2.70.0

References

• GHSA-8r88-6cj9-9fh5
• CVE-2025-48370
• CWE-22
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• materialize-css vulnerable to cross-site Scripting (XSS) due to improper escape of user input - CVE-2022-25349
• React Router vulnerable to Denial of Service via reflected user input in single-fetch - CVE-2026-34077
• FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection - CVE-2026-43945
• nanotar is vulnerable to path traversal in parseTar() and parseTarGzip() - CVE-2025-69874

You might also like:

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

@supabase/auth-js