Executive Summary

This vulnerability exists in the Better Auth authentication and authorization library for TypeScript. The issue is with its HTTP rate limiter, which keys each request by the exact textual IP address found in the x-forwarded-for header or a configured IP-bearing header. IPv6 clients that control a typical /64 allocation can rotate through 2^64 different source addresses without exhausting the per-address rate limit counter. This allows them to bypass rate limiting on sensitive endpoints such as /sign-in/email, /sign-up/email, and /forget-password. Additionally, a single client can vary the textual encoding of one IPv6 address (using uppercase, compression, IPv4-mapped, or hex-encoded IPv4-in-IPv6 formats) to generate multiple distinct keys, further defeating the rate limiting mechanism. The vulnerability was fixed in versions 1.4.17 and 1.5.0-beta.9 of Better Auth.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to bypass rate limiting protections on authentication-related endpoints by rotating through many IPv6 addresses or varying the textual representation of a single IPv6 address. This can lead to increased risk of brute force attacks on sign-in, sign-up, and password reset functionalities, potentially resulting in unauthorized access, account compromise, or denial of service due to resource exhaustion.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade Better Auth to version 1.4.17 or later, or to 1.5.0-beta.9 or later. These versions contain the fix for the HTTP rate limiter issue that allowed IPv6 clients to bypass rate limiting by rotating through distinct source addresses or varying textual encoding.

Useful 0 Not Useful 0