# Better Auth: Rate limiter keys IPv6 addresses individually and is bypassable via prefix rotation

Better Auth rate limiter keyed on raw IPv6 text, so a client with a /64 could rotate 2^64 addresses or re-encode one address to bypass auth rate limits.

- Payout: Research
- Severity: high
- Program: Better Auth
- Found by: nexryai
- Disclosed: 2026-05-15
- CVE: CVE-2026-45364
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-p6v2-xcpg-h6xw
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-p6v2-xcpg-h6xw
- Tags: area:web domain:web impact:ato kind:research platform:ghsa sev:high tech:nodejs technique:parser-differential technique:source-review vuln:auth-bypass vuln:business-logic vuln:misconfiguration

**Target:** HTTP rate limiter on auth endpoints (/sign-in/email, /sign-up/email, /forget-password) keyed by x-forwarded-for
**Root cause:** getIp returned the leftmost x-forwarded-for value verbatim and the rate-limit key was string-concatenated from it, so distinct IPv6 addresses within one /64 (or alternate textual encodings of one address) produced distinct counters.
**Steps:**
1. Deploy better-auth < 1.4.17 with rate limiting enabled and IPv6-reachable endpoints.
2. Send requests to `/sign-in/email` with varying `x-forwarded-for` values drawn from your own /64 (e.g. `2001:db8:1:2::1`, `2001:db8:1:2::2`, ...).
3. Observe each address gets its own rate-limit counter, so attempts are unbounded.
4. Alternatively vary encoding of one address (uppercase, compressed, IPv4-mapped dotted vs hex) to mint new keys.
**How found:** Reporter noticed the rate-limit key was built from the raw textual IP and reasoned that IPv6 prefix allocations plus multiple valid textual representations of one address expand the key space far beyond the client population.
**Exploitation:** Attacker with a single /64 allocation rotates source addresses (or textual encodings) per request to keep every rate-limit bucket fresh, enabling unbounded credential-stuffing/brute-force on sign-in, faster account enumeration, and amplified password-reset/verification email fan-out.
**Insight:** When a rate limiter or any per-client key uses a raw IP string, check whether the address family allows prefix rotation (IPv6 /64) or representation aliasing (RFC 4291 mixed forms, IPv4-mapped) — normalize and mask to a prefix before keying.