Executive brief
Supabase auth-js is a JavaScript library used to handle user authentication and management. The library's user and factor management functions (getUserById, deleteUser, updateUserById, listFactors, deleteFactor) fail to validate that IDs are valid UUIDs, allowing malformed input to cause incorrect API functions to be called through path traversal. Applications that implement proper input validation are unaffected, but those passing unsanitized user input to these functions could experience unexpected behavior or access control issues.
Technical details
This vulnerability is a path traversal flaw (CWE-22) in the auth-js library's handling of userId and factorId parameters. The affected functions (getUserById, deleteUser, updateUserById, listFactors, deleteFactor) did not validate that these parameters were valid UUIDs before using them in URL path construction, allowing an attacker to craft malformed IDs that could route requests to unintended API endpoints. The attack requires the ability to pass unsanitized user input to these functions; applications following security best practices by validating input before calling the library are not affected. A fix has been released requiring strict UUID (v4) validation on all affected parameters in versions 2.70.0 and later.
Affected products
- Supabase auth-js <2.70.0
Timeline
- 2025-05-27: disclosed
- 2025-05-27: patched: Version 2.70.0 released with UUID validation