7.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-45364

CVE-2026-45364: Better Auth: Rate limiter keys IPv6 addresses individually and is bypassable via prefix rotation

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.4.17 and 1.5.0-beta.9, Better Auth's HTTP rate limiter keyed each request by the exact textual IP address it received in x-forwarded-for (or the configured IP-bearing header). IPv6 clients controlling a typical /64 allocation could rotate through 2^64 distinct source addresses without exhausting the per-address counter, defeating rate limiting on /sign-in/email, /sign-up/email, /forget-password, and every other path the limiter protects. The same bug allowed a single client to vary the textual encoding of one IPv6 address (uppercase, compression, IPv4-mapped, hex-encoded IPv4-in-IPv6) and produce multiple distinct keys. This vulnerability is fixed in 1.4.17 and 1.5.0-beta.9.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-45364

CVE-2026-45364:

7.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
better-auth	npm	< 1.4.17	1.4.17
better-auth	npm	>= 1.5.0-beta.1, < 1.5.0-beta.9	1.5.0-beta.9

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in how Better Auth's rate limiter identifies clients. The system used the raw IP address string from the x-forwarded-for header to create a rate-limiting key. This approach is flawed for IPv6 due to two main factors:

Representation Aliasing: IPv6 addresses have multiple valid textual representations (e.g., compressed with ::, uppercase/lowercase hex digits, IPv4-mapped formats). The vulnerable code treated each unique string as a separate client, allowing an attacker to bypass rate limits by simply reformatting the same IP address.
Prefix Rotation: ISPs and cloud providers assign large blocks of IPv6 addresses (typically a /64 subnet containing 2^64 addresses) to a single client. The vulnerable code keyed on individual IP addresses, allowing an attacker to easily cycle through their vast allocation to generate a near-infinite number of unique rate-limit keys, effectively making the rate limiter useless.

The primary vulnerable function was getIp, which extracted the IP without normalization. This un-normalized IP was then used in onRequestRateLimit to construct a weak rate-limit key via simple string concatenation. The fix involved introducing a normalizeIP function to canonicalize IPv6 addresses and, crucially, to group them by a /64 subnet by default, ensuring all traffic from a single client's network is treated as a single entity for rate-limiting purposes.

Vulnerable functions

getIp

packages/better-auth/src/utils/get-request-ip.ts

The `getIp` function was vulnerable because it returned the raw IP address string from the 'x-forwarded-for' header without any normalization. This allowed attackers to bypass rate limiting by providing different textual representations of the same IPv6 address (e.g., '::1' vs '0:0:0:0:0:0:0:1') or by rotating through the millions of addresses available in a standard IPv6 subnet allocation, with each variation being treated as a unique client by the rate limiter.

onRequestRateLimit

packages/better-auth/src/api/rate-limiter/index.ts

This function constructs the key used for rate limiting. The vulnerable version performed a simple string concatenation of the un-normalized IP address and the request path. This meant that the non-unique IP representations from `getIp` were used directly, leading to the rate-limiting bypass. The fix introduces `createRateLimitKey`, which uses a separator ('|') to prevent key collisions and relies on the now-normalized IP address.

normalizeIP

packages/core/src/utils/ip.ts

While this function was introduced as part of the fix, its initial default configuration was still flawed. It defaulted to an IPv6 subnet mask of /128, which treats each IP address individually. This fixed the issue of multiple textual representations but did not fix the bypass vector where an attacker could rotate through the vast number of IPs in their allocated /64 subnet. This was quickly corrected in a subsequent patch to default to /64, which correctly groups IPs from the same subnet.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.