Description
The library functions getUserById, deleteUser, updateUserById, listFactors and deleteFactor did not require the user supplied values to be valid UUIDs. This could lead to a URL path traversal, resulting in the wrong API function being called.
Recommendation
Update the @supabase/auth-js package to the latest compatible version. Followings are version details:
- Affected version(s): <= 2.69.1
- Patched version(s): 2.70.0
References
Could your website be exposed too?
SmartScanner can check your website for auth-js Vulnerable to Insecure Path Routing from Malformed User Input and gives you actionable findings to investigate.
Start a free scanRelated Issues
- materialize-css vulnerable to cross-site Scripting (XSS) due to improper escape of user input - CVE-2022-25349
- React Router vulnerable to Denial of Service via reflected user input in single-fetch - CVE-2026-34077
- FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection - CVE-2026-43945
- nanotar is vulnerable to path traversal in parseTar() and parseTarGzip() - CVE-2025-69874
You might also like:
See something that needs correcting? Let us knowUpdated May 05, 2026