CVE-2026-45364
Rate Limiting Bypass via IPv6 in Better Auth
Publication date: 2026-05-28
Last updated on: 2026-05-28
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| better_auth | better_auth | to 1.4.17|end_excluding=1.5.0-beta.9 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-307 | The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Better Auth authentication and authorization library for TypeScript. The issue is with its HTTP rate limiter, which keys each request by the exact textual IP address found in the x-forwarded-for header or a configured IP-bearing header. IPv6 clients that control a typical /64 allocation can rotate through 2^64 different source addresses without exhausting the per-address rate limit counter. This allows them to bypass rate limiting on sensitive endpoints such as /sign-in/email, /sign-up/email, and /forget-password. Additionally, a single client can vary the textual encoding of one IPv6 address (using uppercase, compression, IPv4-mapped, or hex-encoded IPv4-in-IPv6 formats) to generate multiple distinct keys, further defeating the rate limiting mechanism. The vulnerability was fixed in versions 1.4.17 and 1.5.0-beta.9 of Better Auth.
How can this vulnerability impact me? :
This vulnerability can allow an attacker to bypass rate limiting protections on authentication-related endpoints by rotating through many IPv6 addresses or varying the textual representation of a single IPv6 address. This can lead to increased risk of brute force attacks on sign-in, sign-up, and password reset functionalities, potentially resulting in unauthorized access, account compromise, or denial of service due to resource exhaustion.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade Better Auth to version 1.4.17 or later, or to 1.5.0-beta.9 or later. These versions contain the fix for the HTTP rate limiter issue that allowed IPv6 clients to bypass rate limiting by rotating through distinct source addresses or varying textual encoding.