CVE-2026-45364: Better Auth IPv6 Rate Limiter Bypass

Technical summary

The vulnerability stems from how Better Auth's HTTP rate limiter constructs its cache keys. The library directly uses the textual representation of the IP address extracted from x-forwarded-for (or a configured IP-bearing header) without normalizing the IPv6 address format. IPv6 addresses can be represented multiple valid ways (e.g., 2001:db8::1 vs. 2001:0db8:0000:0000:0000:0000:0000:0001 vs. ::ffff:192.0.2.1 for IPv4-mapped), each producing a distinct string and thus a distinct rate-limit counter entry. Additionally, IPv6 clients with a /64 allocation control 2^64 unique addresses, allowing them to send requests from different source IPs within that range without triggering cumulative rate-limit thresholds. The issue affects all endpoints protected by the library's rate limiter, including /sign-in/email, /sign-up/email, /forget-password, and others.

Business impact

Applications using vulnerable versions of Better Auth face a substantially elevated risk of credential compromise and account takeover. Attackers can bypass rate limiting to conduct brute-force password attacks, enumerate valid email addresses during sign-up, or repeatedly attempt password reset flows without triggering defensive mechanisms. The impact scales with the sensitivity of the authentication logic and the value of the accounts under attack. Compliance postures may also suffer if rate limiting was relied upon to meet regulatory or contractual security requirements.

Affected systems

Any application using Better Auth versions prior to 1.4.17 or 1.5.0-beta.9 is affected. This includes both TypeScript/Node.js applications and those deployed behind reverse proxies that forward client IP via x-forwarded-for or similar headers. Systems that rely on IPv6 connectivity are particularly vulnerable because attackers have access to a far larger pool of source addresses per customer allocation.

Exploitability

Exploitation requires no special privileges, authentication, or user interaction. An attacker with network access can immediately craft requests with varying IPv6 source addresses or encodings to bypass rate limits. The barrier to entry is low: basic familiarity with IPv6 addressing and HTTP requests is sufficient. No exploit code or active KEV activity has been published, but the attack is straightforward to implement once the vulnerability is understood. Organizations using vulnerable versions should treat this as actively exploitable.

Remediation

Update Better Auth to version 1.4.17 or 1.5.0-beta.9 or later immediately. The fix normalizes IPv6 addresses before using them as rate-limit keys, ensuring that different textual representations of the same address, and addresses within the same /64 allocation, map to the same counter. After patching, consider resetting rate-limit counters to prevent stale state from interfering with the corrected logic.

Patch guidance

1. Review your dependency lock file to confirm the installed version of Better Auth. 2. Update to 1.4.17 (for the 1.4.x branch) or 1.5.0-beta.9 (for the 1.5.x beta) or any later release. 3. Test authentication flows (sign-in, sign-up, password reset) in a staging environment to ensure rate limiting now functions correctly. 4. Monitor rate-limit metrics post-deployment to confirm the corrected behavior is in place. 5. If you customized IP-bearing headers in your Better Auth configuration, verify that the normalization applies to your chosen header.

Detection guidance

Review access logs for patterns consistent with rate-limit bypass: multiple failed authentication attempts from different IPv6 addresses within the same /64 subnet, or repeated attempts using different encodings of the same IPv6 address (e.g., compressed and uncompressed forms). Monitor authentication endpoints for unusual spikes in failed login attempts or password reset requests. If you have rate-limit middleware upstream of Better Auth, verify that it is also normalizing IPv6 addresses consistently. Set alerts for repeated failed authentication attempts across multiple apparent source IPs that resolve to the same organizational or ISP allocation.

Why prioritize this

This vulnerability rates HIGH (CVSS 7.3) and should be prioritized for immediate patching. It directly undermines a critical security control—rate limiting on authentication endpoints—and enables brute-force attacks with minimal effort. Unlike vulnerabilities that require social engineering or user interaction, this bypass is automatic and does not depend on user behavior. Organizations using Better Auth for production authentication should patch within 24–48 hours.

Risk score, explained

The CVSS 3.1 score of 7.3 reflects a network-accessible vulnerability (AV:N) with low attack complexity (AC:L) requiring no privileges or user interaction (PR:N, UI:N). The scope is unchanged (S:U), and the impact across confidentiality, integrity, and availability is low (C:L, I:L, A:L). The 'Low' impact designation reflects that the vulnerability does not directly grant code execution or full system compromise, but rather enables a class of attacks (brute-force) that can lead to account compromise, data theft, and service disruption. The score appropriately captures the broad attack surface and ease of exploitation.

Frequently asked questions