Attack Chain

1. An attacker identifies an authentication endpoint (e.g., /sign-in/email) protected by Better Auth’s rate limiter.
2. The attacker sends a request to the authentication endpoint from an IPv6 address.
3. The Better Auth rate limiter extracts the leftmost x-forwarded-for value without proper normalization.
4. The attacker rotates the source IPv6 address within their assigned prefix (e.g., a /64 allocation) or modifies the textual encoding of the IPv6 address (e.g., using compressed or mixed forms).
5. The attacker sends a subsequent request to the same endpoint, using the rotated or modified IPv6 address.
6. The rate limiter treats the new IPv6 address as a distinct client due to the lack of normalization.
7. The attacker repeats steps 4-6 to bypass the rate limit and make unlimited authentication attempts.
8. The attacker performs credential stuffing, account enumeration, or password-reset amplification attacks.

Impact

Successful exploitation of this vulnerability allows attackers to bypass rate limiting on authentication endpoints. This can lead to credential stuffing attacks against /sign-in/email, enabling unauthorized access to user accounts. Account enumeration becomes easier due to the ability to make unlimited requests without being rate limited. Furthermore, attackers can amplify password-reset and email-verification email fan-out, potentially overwhelming email systems and causing denial of service. While this vulnerability does not directly compromise accounts, it weakens the defense-in-depth and increases the risk of successful attacks.

Recommendation

• Upgrade to better-auth@1.4.17 or later to apply the fix that normalizes IPv6 addresses, mitigating the rate-limiting bypass (see Patches section).
• If upgrading is not immediately feasible, and you are on >= 1.4.16, set advanced.ipAddress.ipv6Subnet: 64 in the auth configuration to restore post-1.4.17 behavior (see Workarounds section).
• For versions < 1.4.16, shift the bypass mitigation upstream by configuring IPv6 prefix length limiting on your CDN, WAF, or load balancer to /64 (or coarser per RFC 6177) (see Workarounds section).
• Deploy the Sigma rule “Detect High Volume Authentication Attempts from Single IPv6 /64 Prefix (CVE-2026-45364)” to identify potential exploitation attempts by monitoring authentication logs for excessive attempts from the same /64 IPv6 subnet (see Rules section).