GHSA-p6v2-xcpg-h6xw
High · 7.3CVSS
7.3
EPSS
—
Published
May 15, 2026
CISA due date
—
The record
Better Auth: Rate limiter keys IPv6 addresses individually and is bypassable via prefix rotation
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | better-auth | 0 | 1.4.17 |
| npm | better-auth | 1.5.0-beta.1 | 1.5.0-beta.9 |
Related vulnerabilities
- CVE-2026-45364 Better Auth is an authentication and authorization library for TypeScript. Same vulnerability
- GHSA-cq3f-vc6p-68fh Better Auth: Device authorization approve and deny accept any authenticated session while… Also affects better-auth
- GHSA-wxw3-q3m9-c3jr Better Auth: OAuth callback accepts mismatched `state` when cookie-backed state storage… Also affects better-auth
- GHSA-xg6x-h9c9-2m83 Better Auth Has Two-Factor Authentication Bypass via Premature Session Caching… Also affects better-auth
- GHSA-x732-6j76-qmhm Better Auth's rou3 Dependency has Double-Slash Path Normalization which can Bypass… Also affects better-auth
- GHSA-569q-mpph-wgww Better Auth affected by external request basePath modification DoS Also affects better-auth
- GHSA-wmjr-v86c-m9jj Better Auth's multi-session sign-out hook allows forged cookies to revoke arbitrary… Also affects better-auth
- CVE-2025-61928 Better Auth is an authentication and authorization library for TypeScript. Also affects better-auth