CVE-2026-45364: Better Auth: Rate limiter keys IPv6 addresses individually and is bypassable via prefix rotation

Synopsis

A rate-limiter bypass vulnerability affects Better Auth, a TypeScript authentication and authorization library. The HTTP rate limiter keys each request by the raw textual form of the client IP address received from the x-forwarded-for header, meaning an IPv6 client with a standard /64 prefix allocation can rotate through 2^64 unique addresses and never exhaust any per-address counter. Successful exploitation allows an attacker to brute-force login, account registration, and password-reset endpoints without hitting the intended request cap, enabling credential stuffing, account enumeration, and denial-of-service through resource exhaustion. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to send HTTP requests to the exposed Better Auth endpoint over the network; no local or physical access is needed.

• AuthenticationNot required

  No account or session credential is needed; the attacker hits unauthenticated endpoints such as /sign-in/email and /forget-password directly.

• Victim interactionNot required

  The attack is entirely server-side; no user needs to click a link or take any action for exploitation to succeed.

• Attack complexityDetail

  Exploit is reliable and condition-free: rotating through IPv6 addresses within a standard /64 allocation or varying the textual encoding of a single address requires no special timing or environmental precondition.

Blast Radius

• Attacker submits unlimited login attempts against any account, recovering valid credentials through brute force or credential stuffing.
• Attacker enumerates valid email addresses by observing differential responses from the /sign-up/email and /forget-password endpoints without triggering lockout.
• Attacker modifies account state by successfully resetting passwords or registering duplicate accounts once lockout controls are defeated.
• Attacker degrades service availability by flooding rate-limited endpoints with high request volume, exhausting application and database resources.