CVE-2026-45364— Better Auth: Rate limiter keys IPv6 addresses individually and is bypassable via prefix rotation
Affected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| better-auth | better-auth | < 1.4.17 | affected |
>= 1.5.0-beta.1, < 1.5.0-beta.9 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-45364
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Better Auth: Rate limiter keys IPv6 addresses individually and is bypassable via prefix rotation
Source: NVD (National Vulnerability Database)
Vulnerability Description
Better Auth is an authentication and authorization library for TypeScript. Prior to 1.4.17 and 1.5.0-beta.9, Better Auth's HTTP rate limiter keyed each request by the exact textual IP address it received in x-forwarded-for (or the configured IP-bearing header). IPv6 clients controlling a typical /64 allocation could rotate through 2^64 distinct source addresses without exhausting the per-address counter, defeating rate limiting on /sign-in/email, /sign-up/email, /forget-password, and every other path the limiter protects. The same bug allowed a single client to vary the textual encoding of one IPv6 address (uppercase, compression, IPv4-mapped, hex-encoded IPv4-in-IPv6) and produce multiple distinct keys. This vulnerability is fixed in 1.4.17 and 1.5.0-beta.9.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Source: NVD (National Vulnerability Database)
Vulnerability Type
过多认证尝试的限制不恰当
Source: NVD (National Vulnerability Database)
Vulnerability Title
Better Auth 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Better Auth是Better Auth开源的一个 TypeScript 最全面的身份验证框架。 Better Auth 1.4.17和1.5.0-beta.9之前版本存在安全漏洞，该漏洞源于HTTP速率限制器按x-forwarded-for中的确切文本IP地址键控每个请求，IPv6客户端可轮换2^64个不同源地址或改变IPv6地址的文本编码来绕过速率限制。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| better-auth | better-auth | < 1.4.17 | - |
II. Public POCs for CVE-2026-45364
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-45364
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-45364 (3)
Vendor Advisories for CVE-2026-45364 (1)
IV. Related Vulnerabilities
Same product: better-auth
- CVE-2026-41427
Better Auth OAuth 2.1 Provider: Unprivileged users can regis - CVE-2025-61928
Better Auth: Unauthenticated API key creation through api-ke - CVE-2025-53535
Better Auth has an Open Redirect Vulnerability in originChec - CVE-2025-27143
Beter Auth has an Open Redirect via Scheme-Less Callback Par - CVE-2024-56734
Better Auth has an Open Redirect Vulnerability in Verify Ema
Same vendor: better-auth
- CVE-2026-41427
Better Auth OAuth 2.1 Provider: Unprivileged users can regis - CVE-2025-61928
Better Auth: Unauthenticated API key creation through api-ke - CVE-2025-53535
Better Auth has an Open Redirect Vulnerability in originChec - CVE-2025-27143
Beter Auth has an Open Redirect via Scheme-Less Callback Par - CVE-2024-56734
Better Auth has an Open Redirect Vulnerability in Verify Ema
Same weakness: CWE-307
- CVE-2026-10216
unitedbyai droidclaw claim Endpoint pairing.ts excessive aut - CVE-2026-35675
phpMyFAQ - Authentication Bypass via Missing Password Reset - CVE-2026-8760
Login with OTP <= 1.6 - Unauthenticated Authentication Bypas - CVE-2026-1816
OTP Bypass in TEİAŞ's Mobile Application - CVE-2020-37228
iDS6 DSSPro Digital Signage System 6.2 CAPTCHA Security Bypa
V. Comments for CVE-2026-45364
No comments yet