Listen to this Post
The vulnerability affects Better Auth’s HTTP rate limiter before versions 1.4.17 and 1.5.0-beta.9. The root cause lies in the `getIp` function, which extracts the leftmost `x-forwarded-for` header value verbatim after a basic validity check. The `onRequestRateLimit` function then constructs a rate-limit key by simple string concatenation of this IP string with the request path. IPv6 introduces two bypass vectors: prefix rotation and representation aliasing. An attacker with a typical /64 IPv6 prefix (2^64 addresses) can rotate through unique source addresses, each generating a different rate-limit key, effectively bypassing per-address counters on endpoints like /sign-in/email, /sign-up/email, and /forget-password. Additionally, a single IPv6 address can be represented in multiple textual forms (uppercase hex, compressed notation, IPv4-mapped `::ffff:0:0/96` as dotted-decimal or hex), each creating distinct keys. The fix in 1.4.17 introduces normalizeIP, which expands compressed forms, lowercases hex digits, converts IPv4-mapped to plain IPv4, and applies a /64 prefix mask. The rate-limit key now uses a `|` separator to avoid collisions. The default prefix length changed from /128 to /64, ensuring all addresses in a /64 allocation map to the same key. PR 7470 added the normalization utility, and PR 7509 changed the default. Workarounds: on >=1.4.16 set advanced.ipAddress.ipv6Subnet: 64; on <1.4.16 enforce /64 prefix at CDN/WAF level (Cloudflare, AWS WAF, etc.). The impact allows unbounded authentication attempts, credential stuffing, account enumeration, and email amplification without direct compromise.
dailycve form:
Platform: Better Auth
Version: <1.4.17,<=1.5.0-beta.8
Vulnerability: Rate limit bypass
Severity: High (7.5)
date: 2025-01-15 (approx)
Prediction: Patch already available
Analytics under What Undercode Say:
Check vulnerable version
npm list better-auth | grep -E "1.[0-3].|1.4.[0-9]|1.4.1[0-6]|1.5.0-beta.[0-8]"
Simulate IPv6 prefix rotation (conceptual)
for suffix in {1..1000}; do
curl -H "X-Forwarded-For: 2001:db8::1:$suffix" \
-X POST https://app.com/sign-in/email
done
Test representation aliasing with same IPv6
curl -H "X-Forwarded-For: 2001:db8::1" ...
curl -H "X-Forwarded-For: 2001:DB8::1" ...
curl -H "X-Forwarded-For: ::ffff:192.0.2.1" ...
Fix verification after upgrade
node -e "const { normalizeIP } = require('better-auth'); console.log(normalizeIP('2001:DB8::1'))"
Exploit:
Attacker controls a /64 IPv6 prefix (e.g., from cloud VM). Sends repeated requests to `/sign-up/email` with distinct source addresses from that prefix via X-Forwarded-For. Each request gets a unique rate-limit key, bypassing limits. Also uses mixed-case or compressed IPv6 strings to multiply keys from one address. No authentication needed.
Protection from this CVE
Upgrade to >=1.4.17 or >=1.5.0-beta.9. If upgrade impossible, set `advanced.ipAddress.ipv6Subnet: 64` in config (v1.4.16+). For older versions, configure upstream proxy/CDN to normalize IPv6 to /64 prefix before passing X-Forwarded-For. Disable IPv6 if not needed. Tighten customRules window for sensitive endpoints.
Impact
Unbounded brute-force and credential stuffing on authentication endpoints. Faster account enumeration via response timing/differences. Email flood on password-reset and verification. No direct account takeover without valid credentials, but removes defense-in-depth. Affects any IPv6-reachable deployment with default rate-limiter configuration.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
