CVE-2026-45364

The record

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.4.17 and 1.5.0-beta.9, Better Auth's HTTP rate limiter keyed each request by the exact textual IP address it received in x-forwarded-for (or the configured IP-bearing header). IPv6 clients controlling a typical /64 allocation could rotate through 2^64 distinct source addresses without exhausting the per-address counter, defeating rate limiting on /sign-in/email, /sign-up/email, /forget-password, and every other path the limiter protects. The same bug allowed a single client to vary the textual encoding of one IPv6 address (uppercase, compression, IPv4-mapped, hex-encoded IPv4-in-IPv6) and produce multiple distinct keys. This vulnerability is fixed in 1.4.17 and 1.5.0-beta.9.

Affected packages

Related vulnerabilities

• GHSA-p6v2-xcpg-h6xw Better Auth: Rate limiter keys IPv6 addresses individually and is bypassable via prefix… Same vulnerability
• GHSA-cq3f-vc6p-68fh Better Auth: Device authorization approve and deny accept any authenticated session while… Also affects better-auth
• GHSA-wxw3-q3m9-c3jr Better Auth: OAuth callback accepts mismatched `state` when cookie-backed state storage… Also affects better-auth
• GHSA-xg6x-h9c9-2m83 Better Auth Has Two-Factor Authentication Bypass via Premature Session Caching… Also affects better-auth
• GHSA-x732-6j76-qmhm Better Auth's rou3 Dependency has Double-Slash Path Normalization which can Bypass… Also affects better-auth
• GHSA-569q-mpph-wgww Better Auth affected by external request basePath modification DoS Also affects better-auth
• GHSA-wmjr-v86c-m9jj Better Auth's multi-session sign-out hook allows forged cookies to revoke arbitrary… Also affects better-auth
• CVE-2025-61928 Better Auth is an authentication and authorization library for TypeScript. Also affects better-auth