CVE-2026-45364: Better Auth: Rate limiter keys IPv6 addresses individually and is bypassable via prefix rotation
(updated )
Better Auth’s HTTP rate limiter keyed each request by the exact textual IP address it received in x-forwarded-for (or the configured IP-bearing header). IPv6 clients controlling a typical /64 allocation could rotate through 2^64 distinct source addresses without exhausting the per-address counter, defeating rate limiting on /sign-in/email, /sign-up/email, /forget-password, and every other path the limiter protects. The same bug allowed a single client to vary the textual encoding of one IPv6 address (uppercase, compression, IPv4-mapped, hex-encoded IPv4-in-IPv6) and produce multiple distinct keys.
References
- github.com/advisories/GHSA-p6v2-xcpg-h6xw
- github.com/better-auth/better-auth/commit/43e719bcc0c223c7079fa0c611a9cf7ea1188254
- github.com/better-auth/better-auth/commit/57af0f7b910dcf7b1a5c0615d10b9bd56bb69bef
- github.com/better-auth/better-auth/pull/7470
- github.com/better-auth/better-auth/pull/7509
- github.com/better-auth/better-auth/security/advisories/GHSA-p6v2-xcpg-h6xw
- nvd.nist.gov/vuln/detail/CVE-2026-45364
Code Behaviors & Features
Detect and mitigate CVE-2026-45364 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →