auth-js Kwetsbaar voor Insecure Path Routing door Slechte Gebruikersinvoer

The vulnerability lies in the getUserById, deleteUser, updateUserById, listFactors, and deleteFactor functions within auth-js. Because these functions do not properly validate the userId and factorId parameters as valid UUIDs (v4 format), a malicious actor can craft a URL that bypasses intended API calls. This could lead to unauthorized access or modification of data, depending on the underlying application logic. While implementations that already validate user inputs are not vulnerable, many applications may not have such protections in place, creating a significant attack surface. The potential impact ranges from data exposure to privilege escalation, depending on the application’s configuration and the attacker’s ability to exploit the bypassed API calls.

Applications utilizing auth-js version 2.70.0 or earlier, particularly those lacking robust input validation on user-supplied identifiers, are at risk. Shared hosting environments where multiple applications share the same auth-js instance could amplify the impact, as a vulnerability in one application could potentially expose others.

• nodejs:

  npm list auth-js
  # Check version. If <= 2.70.0, the system is vulnerable.

• generic web:

  curl -I 'https://your-application.com/api/auth/user/invalid-uuid' # Check for unexpected API responses or errors indicating path traversal.

1. 2025-05-27Disclosure

   disclosure

1. Gereserveerd2025-05-19
2. Gepubliceerd2025-05-27
3. Gewijzigd2026-04-27
4. EPSS bijgewerkt2026-03-23

The primary mitigation is to upgrade to auth-js version 2.70.0 or later. This version includes strict UUID validation checks for the affected API functions, preventing the path traversal vulnerability. If upgrading immediately is not feasible, consider implementing input validation on the application side to ensure that userId and factorId parameters conform to the UUID v4 format before passing them to the auth-js library. While not a complete solution, this can reduce the attack surface. Monitor application logs for unusual API calls or requests containing invalid UUIDs, which could indicate an attempted exploitation. There are no specific WAF rules or Sigma/YARA patterns readily available for this vulnerability, making application-level validation and log monitoring crucial.