CVE-2025-48370: Path Traversal in auth-js

The vulnerability lies in the getUserById, deleteUser, updateUserById, listFactors, and deleteFactor functions within auth-js. Because these functions do not properly validate the userId and factorId parameters as valid UUIDs (v4 format), a malicious actor can craft a URL that bypasses intended API calls. This could lead to unauthorized access or modification of data, depending on the underlying application logic. While implementations that already validate user inputs are not vulnerable, many applications may not have such protections in place, creating a significant attack surface. The potential impact ranges from data exposure to privilege escalation, depending on the application’s configuration and the attacker’s ability to exploit the bypassed API calls.

1. Reserved2025-05-19
2. Published2025-05-27
3. Modified2026-04-27
4. EPSS updated2026-03-23

The primary mitigation is to upgrade to auth-js version 2.70.0 or later. This version includes strict UUID validation checks for the affected API functions, preventing the path traversal vulnerability. If upgrading immediately is not feasible, consider implementing input validation on the application side to ensure that userId and factorId parameters conform to the UUID v4 format before passing them to the auth-js library. While not a complete solution, this can reduce the attack surface. Monitor application logs for unusual API calls or requests containing invalid UUIDs, which could indicate an attempted exploitation. There are no specific WAF rules or Sigma/YARA patterns readily available for this vulnerability, making application-level validation and log monitoring crucial.