CVE-2026-45364: Better Auth rate limit bypass via IPv6 address rotation and encoding

Executive brief

Better Auth is an authentication library for web applications. A flaw in its rate-limiting system allows attackers using IPv6 connections to bypass security limits on sensitive actions like signing in or resetting passwords. This could allow an attacker to perform unlimited login attempts or send excessive automated emails, potentially leading to account takeovers or service abuse.

Technical details

The Better Auth HTTP rate limiter improperly keyed requests using the verbatim textual IP address from headers like 'x-forwarded-for'. Because IPv6 allows for multiple textual representations of the same address and ISPs typically assign large address blocks (prefixes) to single users, attackers could rotate through billions of source addresses or vary the string encoding to bypass per-IP counters. This affects critical endpoints including sign-in, sign-up, and password resets. The fix introduces IP normalization and applies a default /64 prefix mask to treat entire subnets as a single client.

Affected products

• better-auth better-auth < 1.4.17, >= 1.5.0-beta.1 < 1.5.0-beta.9

Timeline

• 2026-05-11: disclosed
• 2026-05-15: advisory
• 2026-05-28: kev added: NVD publication date

References

• https://api.github.com/users/nexryai
• https://github.com/nexryai
• https://api.github.com/users/nexryai/gists%7B/gist_id%7D
• https://api.github.com/users/nexryai/repos
• https://avatars.githubusercontent.com/u/61890205?v=4
• https://api.github.com/users/nexryai/events%7B/privacy%7D