The library exposed getUserById, deleteUser, updateUserById, listFactors, and deleteFactor endpoints that did not enforce that supplied identifiers were valid UUIDs. An attacker could supply malformed or crafted identifiers that triggered URL path traversal, causing the library to call an unintended API function. This flaw, tied to CWE-22 (Path Traversal) and CWE-287 (Improper Authentication), enables unauthorized access to API operations that the attacker should not perform, potentially leading to privilege escalation or data exposure.

Supabase's auth-js JavaScript library, used in both client and server environments, is affected in all releases before 2.70.0. Implementations that validate the userId or other parameters before calling the library are not impacted. The vulnerability was fixed in auth‑js version 2.70.0 and later.

The CVSS score of 2.7 classifies this vulnerability as low severity, and the EPSS score of <1% indicates an extremely low probability of exploitation. Based on the description, the most likely attack vector involves an attacker sending crafted requests with malformed identifiers to a client or server that uses the vulnerable version of auth‑js. Because the flaw depends on malformed user input, such requests may trigger unintended API functions. The risk is mitigated in environments that enforce strict UUID validation or have applied the patch, and there is no evidence that this vulnerability appears in the CISA KEV catalog.