CVE-2026-45364

🗓️ 28 May 2026 21:34:51Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 35 Views🌐 WEB

Better Auth rate limiter uses exact textual IP, enabling IPv six address rotation and encoding to bypass limits.

Reporter	Title	Published	Views	Family All 16
CNNVD	Better Auth 安全漏洞	28 May 202600:00	–	cnnvd
Cvelist	CVE-2026-45364 Better Auth: Rate limiter keys IPv6 addresses individually and is bypassable via prefix rotation	28 May 202621:34	–	cvelist
EUVD	EUVD-2026-33073	28 May 202621:34	–	euvd
Github Security Blog	Better Auth: Rate limiter keys IPv6 addresses individually and is bypassable via prefix rotation	15 May 202617:41	–	github
NVD	CVE-2026-45364	28 May 202622:17	–	nvd
OSV	CVE-2026-45364 Better Auth: Rate limiter keys IPv6 addresses individually and is bypassable via prefix rotation	28 May 202621:34	–	osv
OSV	GHSA-P6V2-XCPG-H6XW Better Auth: Rate limiter keys IPv6 addresses individually and is bypassable via prefix rotation	15 May 202617:41	–	osv
Patchstack	NPM: Better Auth: Rate limiter keys IPv6 addresses individually and is bypassable via prefix rotation	15 May 202617:41	–	patchstack
Positive Technologies	PT-2026-41393	15 May 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-45364	5 Jun 202619:18	–	redhatcve

Vulners

Node

better-auth better_authRange<1.4.17

better-auth better_authRange1.5.0-beta.1–1.5.0-beta.9

[
  {
    "vendor": "better-auth",
    "product": "better-auth",
    "versions": [
      {
        "version": "< 1.4.17",
        "status": "affected"
      },
      {
        "version": ">= 1.5.0-beta.1, < 1.5.0-beta.9",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/better-auth/better-auth/pull/7509
github	www.github.com/better-auth/better-auth/security/advisories/GHSA-p6v2-xcpg-h6xw
github	www.github.com/better-auth/better-auth/pull/7470
github	www.github.com/better-auth/better-auth/commit/57af0f7b910dcf7b1a5c0615d10b9bd56bb69bef
github	www.github.com/better-auth/better-auth/commit/43e719bcc0c223c7079fa0c611a9cf7ea1188254

Parameter	Position	Path	Description	CWE
X-Forwarded-For	path	/sign-in/email	Rate limiter keys on exact textual IP; IPv6 and header encoding allow multiple keys bypassing per-address limits.	CWE-307
IP-bearing header	path	/sign-in/email	Rate limiter keys on exact textual IP; IPv6 and header encoding allow multiple keys bypassing per-address limits.	CWE-307
X-Forwarded-For	path	/sign-up/email	Rate limiter keys on exact textual IP; IPv6 and header encoding allow multiple keys bypassing per-address limits.	CWE-307
IP-bearing header	path	/sign-up/email	Rate limiter keys on exact textual IP; IPv6 and header encoding allow multiple keys bypassing per-address limits.	CWE-307
X-Forwarded-For	path	/forget-password	Rate limiter keys on exact textual IP; IPv6 and header encoding allow multiple keys bypassing per-address limits.	CWE-307
IP-bearing header	path	/forget-password	Rate limiter keys on exact textual IP; IPv6 and header encoding allow multiple keys bypassing per-address limits.	CWE-307

21 Jul 2026 10:10Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.17.3

EPSS0.00295

SSVC

CWE-307