GHSA-p6v2-xcpg-h6xw Better Auth: Rate limiter keys IPv6 addresses individually and is bypassable via prefix rotation

• npm better-auth: < 1.4.17 → fixed in 1.4.17 • npm better-auth: >= 1.5.0-beta.1, < 1.5.0-beta.9 → fixed in 1.5.0-beta.9

Am I affected? Users are affected if all of the following are true: • Their app uses `better-auth` at a version `= 1.4.16`: set `advanced.ipAddress.ipv6Subnet: 64` in the auth configuration. The `normalizeIP` helper is present at `1.4.16`; only the default is wrong. This restores the post-`1.4.17` behavior on stock config. • On `< 1.4.16`: shift the bypass mitigation upstream. Set the IPv6 prefix length on the app's CDN, WAF, or load balancer rate-limit policy to `/64` (or coarser per RFC 6177 if the app serves residential traffic). Cloudflare, Vercel Firewall, AWS WAF, and Google Cloud Armor all support per-prefix rate limiting. • As a partial mitigation on any version**: tighten the `customRules` window for sign-in, sign-up, and password-reset endpoints. This narrows the abuse window but does not close it. Impact The bypass enables unbounded authentication attempts from a single IPv6-capable client. Direct consequences: • Credential-stuffing and brute-force on `/sign-in/email` are no longer rate-limited per client. • Account enumeration via response-shape differences becomes faster. • Password-reset and email-verification email fan-out can be amplified. The bypass does not directly compromise any account. Successful exploitation still requires the attacker to guess a credential the password store accepts. The rating reflects the loss of one defense-in-depth layer rather than a direct compromise. Credit Reported by `@nexryai` on GitHub. Resources • CWE-307: Improper Restriction of Excessive Authentication Attempts • RFC 4291: IP Version 6 Addressing Architecture • RFC 5952: A Recommendation for IPv6 Address Text Representation • RFC 6177: IPv6 Address Assignment to End Sites