# Ratelimiting can be bypassed using IPv6 subnets

Nextcloud normalizes IPv6 addresses to /128, so attackers with a /64 or /48 subnet can rotate addresses to bypass bruteforce throttling and rate limiting.

- Payout: hidden
- Severity: low
- Program: Nextcloud
- Found by: sjw
- Disclosed: 2021-07-01
- CVE: CVE-2021-22915
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1154003
- Library page: https://bugbountylibrary.com/r/h1%3A1154003
- Tags: area:web domain:web impact:ato kind:bounty platform:hackerone sev:low tech:php technique:source-review vuln:auth-bypass vuln:misconfiguration

**Target:** Nextcloud server IP normalization, bruteforce throttler and rate limiter
**Root cause:** IpAddress normalizer hardcodes IPv6 subnet mask to /128 instead of /64 or larger, so each address in an attacker's subnet is treated as a distinct client.
**Steps:**
1. Read `lib/private/Security/Normalizer/IpAddress.php#L107-L110` showing /128 IPv6 masking.
2. Note Throttler.php#L132 and Limiter.php#L84 key on the normalized IP.
3. Obtain a /64 or /48 IPv6 allocation from a provider.
4. Send bruteforce/rate-limited requests rotating source addresses across the subnet.
5. Observe throttling and rate limits never trigger.
**How found:** Code review of the IP normalizer noticed IPv6 hardcoded to /128, then traced its use in the bruteforce Throttler and Rate Limiter, realizing real-world /64 and /48 allocations make per-IP tracking trivial to evade.
**Exploitation:** Attacker rotates source IPv6 addresses within their assigned /48 or /64 subnet for each login or rate-limited request, so per-IP counters never accumulate and bruteforce protection and rate limiting are effectively disabled.
**Insight:** When auditing rate limiting or lockout logic, check how client identity is derived from IP: IPv6 masking to /128 (or /128-equivalent) lets an attacker with a /64 allocation rotate addresses freely; verify the normalizer uses at least /64.