supabase @supabase/auth-js vulnerabilities

Latest supabase @supabase/auth-js CVEs

Newest publication first

1. CVE-2025-48370 auth-js Vulnerable to Insecure Path Routing from Malformed User Input

   Published 2025-05-27

   Low·CVSS 2.7 EPSS 0.90%

   auth-js is an isomorphic Javascript library for Supabase Auth. Prior to version 2.70.0, the library functions getUserById, deleteUser, updateUserById, listFactors and deleteFactor did not require the user supplied values to be valid UUIDs. This could lead to a URL path traversal,...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.