Is CVE-2025-48370 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-48370 being exploited in the wild.

How severe is CVE-2025-48370?

Medium severity, with a CVSS score of 4, published 27 May 2025.

Which products and versions are affected?

@supabase/auth-js (npm) SEMVER:introduced=0,fixed=2.70.0.

Is there a fix for CVE-2025-48370?

Yes. @supabase/auth-js (npm): upgrade to 2.70.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-48370 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-48370?

Check whether you run @supabase/auth-js (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-48370: Supabase auth-js insecure path routing in user and factor functions

CVE-2025-48370 · Severity: medium · CVSS 4 · Published 2025-05-27

Supabase auth-js is a JavaScript library used to handle user authentication and management. The library's user and factor management functions (getUserById, deleteUser, updateUserById, listFactors, deleteFactor) fail to validate that IDs are valid UUIDs, allowing malformed input to cause incorrect API functions to be called through path traversal. Applications that implement proper input validation are unaffected, but those passing unsanitized user input to these functions could experience unexpected behavior or access control issues.

Vendors: npm.

Quick answers

Is CVE-2025-48370 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-48370 being exploited in the wild.
How severe is CVE-2025-48370?: Medium severity, with a CVSS score of 4, published 27 May 2025.
Which products and versions are affected?: @supabase/auth-js (npm) SEMVER:introduced=0,fixed=2.70.0.
Is there a fix for CVE-2025-48370?: Yes. @supabase/auth-js (npm): upgrade to 2.70.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-48370 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-48370?: Check whether you run @supabase/auth-js (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@supabase/auth-js (npm): upgrade to 2.70.0 or later
```
npm install @supabase/auth-js@2.70.0
```

Technical details

This vulnerability is a path traversal flaw (CWE-22) in the auth-js library's handling of userId and factorId parameters. The affected functions (getUserById, deleteUser, updateUserById, listFactors, deleteFactor) did not validate that these parameters were valid UUIDs before using them in URL path construction, allowing an attacker to craft malformed IDs that could route requests to unintended API endpoints. The attack requires the ability to pass unsanitized user input to these functions; applications following security best practices by validating input before calling the library are not affected. A fix has been released requiring strict UUID (v4) validation on all affected parameters in versions 2.70.0 and later.

Affected products

Supabase auth-js <2.70.0

Identifiers

CVE-2025-48370
GHSA-8r88-6cj9-9fh5

Timeline

2025-05-27: disclosed
2025-05-27: patched: Version 2.70.0 released with UUID validation

References

https://github.com/supabase/auth-js/security/advisories/GHSA-8r88-6cj9-9fh5

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.