CVE-2026-45364

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.4.17 and 1.5.0-beta.9, Better Auth's HTTP rate limiter keyed each request by the exact textual IP address it received in x-forwarded-for (or the configured IP-bearing header). IPv6 clients controlling a typical /64 allocation could rotate through 2^64 distinct source addresses without exhausting the per-address counter, defeating rate limiting on /sign-in/email, /sign-up/email, /forget-password, and every other path the limiter protects. The same bug allowed a single client to vary the textual encoding of one IPv6 address (uppercase, compression, IPv4-mapped, hex-encoded IPv4-in-IPv6) and produce multiple distinct keys. This vulnerability is fixed in 1.4.17 and 1.5.0-beta.9.

• CWE-307

• https://github.com/better-auth/better-auth/commit/43e719bcc0c223c7079fa0c611a9cf7ea1188254
• https://github.com/better-auth/better-auth/commit/57af0f7b910dcf7b1a5c0615d10b9bd56bb69bef
• https://github.com/better-auth/better-auth/pull/7470
• https://github.com/better-auth/better-auth/pull/7509
• https://github.com/better-auth/better-auth/security/advisories/GHSA-p6v2-xcpg-h6xw

Published

May 28, 2026

Last Modified

Jul 21, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-45359ImageMagick is free and open-source software used for editin…5.7
• CVE-2026-4536A vulnerability was found in Acrel Environmental Monitoring …7.3
• CVE-2026-45360Apache Airflow's scheduler-side deadline-reference decoder (…7.3
• CVE-2026-45361Apache Airflow providers-google's `ComputeEngineSSHHook` dis…8.1
• CVE-2026-45362Sangoma Switchvox before 8.4 places cleartext SIP authentica…3.2
• CVE-2026-45363ruby-jwt is a Ruby implementation of the RFC 7519 OAuth JSON…9.1
• CVE-2026-45365Open WebUI is a self-hosted artificial intelligence platform…5.4
• CVE-2026-45366typescript-utcp is a typescript implementation of UTCP. Prio…4.7
• CVE-2026-45367HAPI FHIR is a complete implementation of the HL7 FHIR stand…7.5
• CVE-2026-45368Kirby is an open-source content management system. In versio…8.4
• CVE-2026-45369python-utcp is the python implementation of UTCP. Prior to 1…8.3
• CVE-2026-4537A vulnerability was determined in Cudy TR1200 R46-2.4.15-202…4.7