supabase-audit-auth-users

To test Supabase authentication for user enumeration, audit signup, token, recovery, and OTP endpoints to identify information leakage through distinct error messages, response timing differences, or status codes. This prevents attackers from discovering valid user accounts for targeted attacks.

User enumeration in authentication flows is a vulnerability where attackers determine if specific user accounts exist by analyzing distinct error messages, response timing, or status codes from signup, login, or recovery endpoints, enabling targeted phishing or brute force attacks against confirmed valid accounts.

Yes, you need your Supabase URL and anon key to perform a targeted security assessment of authentication endpoints. These credentials allow the audit tool to interact directly with your signup, token, recovery, and OTP flows to detect user enumeration risks accurately.

The best way to prevent attackers from discovering valid user accounts is to audit Supabase authentication endpoints for information leakage before deployment. Identifying distinct error messages, response timing differences, and status codes allows you to patch flaws that expose valid user accounts.

Supabase login endpoints may return different error messages for existing versus non-existing users due to unoptimized authentication flow configurations. This discrepancy creates a user enumeration vulnerability, allowing attackers to identify valid accounts by analyzing the distinct responses or timing differences.