CVE-2026-45364 json
Better Auth: Rate limiter keys IPv6 addresses individually and is bypassable via prefix rotation
published 2026-05-15 5 mo ago modified 2026-07-21 3 mo ago also EUVD-2026-33073 , GHSA-p6v2-xcpg-h6xw
- cvss
- 7.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 22%
- public exploits
- 0
- none known
Summary
Better Auth is an authentication and authorization library for TypeScript. Prior to 1.4.17 and 1.5.0-beta.9, Better Auth's HTTP rate limiter keyed each request by the exact textual IP address it received in x-forwarded-for (or the configured IP-bearing header). IPv6 clients controlling a typical /64 allocation could rotate through 2^64 distinct source addresses without exhausting the per-address counter, defeating rate limiting on /sign-in/email, /sign-up/email, /forget-password, and every other path the limiter protects. The same bug allowed a single client to vary the textual encoding of one IPv6 address (uppercase, compression, IPv4-mapped, hex-encoded IPv4-in-IPv6) and produce multiple distinct keys. This vulnerability is fixed in 1.4.17 and 1.5.0-beta.9.
Patch / fix
- npm better-auth 1.4.17, 1.5.0-beta.9
- better-auth better_auth 1.4.17, 1.5.0-beta.9
- github.com/better-auth/better-auth@43e719b commit
- github.com/better-auth/better-auth@57af0f7 commit
- github.com/better-auth/better-auth#7470 pull request
- github.com/better-auth/better-auth#7509 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 5 mo ago
Exploit prediction
0.29% chance of exploitation in the next 30 days, higher than 22% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
| GitHub | 3.1 | 7.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | better-auth | <1.4.17 >=1.5.0-beta.1, <1.5.0-beta.9 |
1.4.17 1.5.0-beta.9 |
Affected products
- better-auth better-auth
Classification
- Weakness
-
- CWE-307 Improper Restriction of Excessive Authentication Attempts
References
-
github.com
/better-auth/better-auth/pull/7470
web
-
github.com
/better-auth/better-auth/pull/7509
web
-
github.com
/better-auth/better-auth/commit/43e719bcc0c223c7079fa0c611a9cf7ea1188254
web
-
github.com
/better-auth/better-auth/commit/57af0f7b910dcf7b1a5c0615d10b9bd56bb69bef
web
-
github.com
/better-auth/better-auth/security/advisories/GHSA-p6v2-xcpg-h6xw
web
-
nvd.nist.gov
/vuln/detail/CVE-2026-45364
advisory
-
github.com
/better-auth/better-auth
package
Sources
- CVE List CVE-2026-45364
- GitHub Advisory GHSA-p6v2-xcpg-h6xw
- NVD CVE-2026-45364
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.