Authentication Library Vulnerability in Better Auth for TypeScript
CVE-2026-45364
What is CVE-2026-45364?
The Better Auth library for TypeScript experienced a significant vulnerability prior to version 1.4.17 and 1.5.0-beta.9. This issue arose from its HTTP rate limiter, which relied on the exact textual representation of the IP address from incoming requests. Consequently, IPv6 clients with typical address allocations could circumvent limiting measures by rotating through numerous unique addresses. Additionally, variations in the representation of a single IPv6 address (such as through uppercase letters or compression) allowed malicious clients to exploit the rate limiter on sensitive endpoints, including sign-in, sign-up, and password recovery routes. Updates in versions 1.4.17 and 1.5.0-beta.9 have addressed this flaw, reinforcing security protocols.
Affected Version(s)
better-auth < 1.4.17 < 1.4.17
better-auth >= 1.5.0-beta.1, < 1.5.0-beta.9 < 1.5.0-beta.1, 1.5.0-beta.9