PT-2025-23011 · Auth-Js · Auth-Js
Kos0Ng
·
Publicado
2025-05-27
·
Atualizado
2026-04-27
·
CVE-2025-48370
CVSS v4.0
2.7
Baixa
| Vetor | AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U |
Name of the Vulnerable Software and Affected Versions
auth-js versions prior to 2.69.1
Description
The issue concerns the auth-js library, an isomorphic Javascript library for Supabase Auth. Prior to version 2.69.1, certain library functions such as
getUserById, deleteUser, updateUserById, listFactors, and deleteFactor did not validate user-supplied values as valid UUIDs. This could lead to a URL path traversal, resulting in the wrong API function being called. However, implementations that follow security best practices and validate user-controlled inputs, such as the userId, are not affected by this issue.Recommendations
For versions prior to 2.69.1, update to version 2.69.1 to resolve the issue. As a temporary workaround, consider validating user-controlled inputs, such as the
userId, to ensure they are valid UUIDs before passing them to the affected library functions. Restrict access to the vulnerable functions until the update can be applied.Exploit
Correção
Path traversal
Improper Authentication
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Auth-Js