CVE-2025-48370
Last modified
CVE-2025-48370 is a low-severity vulnerability rated 2.7/10 on the CVSS scale. auth-js is an isomorphic Javascript library for Supabase Auth. Prior to version 2.70.0, the library functions getUserById, deleteUser, updateUserById, listFactors and deleteFactor did not require the user supplied values to be valid UUIDs. EPSS estimates a 0.74% chance of exploitation in the next 30 days.
Description
auth-js is an isomorphic Javascript library for Supabase Auth. Prior to version 2.70.0, the library functions getUserById, deleteUser, updateUserById, listFactors and deleteFactor did not require the user supplied values to be valid UUIDs. This could lead to a URL path traversal, resulting in the wrong API function being called. Implementations that follow security best practice and validate user controlled inputs, such as the userId are not affected by this. This issue has been patched in version 2.70.0.
Metrics
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2025-48370?
How severe is CVE-2025-48370?
How do I fix CVE-2025-48370?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-48365Improper Neutralization of Input During Web Page Generation …5.9
- CVE-2025-48366Group-Office is an enterprise customer relationship manageme…5.4
- CVE-2025-48367Redis is an open source, in-memory database that persists on…7.5
- CVE-2025-48368Group-Office is an enterprise customer relationship manageme…5.4
- CVE-2025-48369Group-Office is an enterprise customer relationship manageme…5.4
- CVE-2025-4837A vulnerability classified as critical has been found in pro…9.8
- CVE-2025-48371OpenFGA is an authorization/permission engine. OpenFGA versi…8.8
- CVE-2025-48372Schule is open-source school management system software. The…7.3
- CVE-2025-48373Schule is open-source school management system software. The…9.1
- CVE-2025-48374zot is ancontainer image/artifact registry based on the Open…5.5
- CVE-2025-48375Schule is open-source school management system software. Pri…5.3
- CVE-2025-48376DNN (formerly DotNetNuke) is an open-source web content mana…2.4
Are you affected by CVE-2025-48370?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST