{"action":"Upgrade better-auth to 1.4.17 or later.","affected":[{"fixed":"1.4.17","introduced":"0"},{"fixed":"1.5.0-beta.9","introduced":"1.5.0-beta.1"}],"component":"better-auth","cve_ids":["CVE-2026-45364"],"ecosystem":"npm","epss":0.00501,"exploited":false,"fixed_versions":["1.4.17","1.5.0-beta.9"],"ghsa_id":"GHSA-p6v2-xcpg-h6xw","id":"tcs_01M5KG2T5FSF8NPJ2B84J66J45","modified_at":"2026-06-09T10:30:12.794111806Z","published_at":"2026-05-15T17:41:37Z","references":["https://osv.dev/vulnerability/GHSA-p6v2-xcpg-h6xw","https://github.com/better-auth/better-auth/security/advisories/GHSA-p6v2-xcpg-h6xw","https://nvd.nist.gov/vuln/detail/CVE-2026-45364","https://github.com/better-auth/better-auth/pull/7470","https://github.com/better-auth/better-auth/pull/7509","https://github.com/better-auth/better-auth/commit/43e719bcc0c223c7079fa0c611a9cf7ea1188254","https://github.com/better-auth/better-auth/commit/57af0f7b910dcf7b1a5c0615d10b9bd56bb69bef","https://github.com/better-auth/better-auth"],"severity":{"label":"high","score":7.3},"sources":[{"source":"osv","source_id":"GHSA-p6v2-xcpg-h6xw","url":"https://osv.dev/vulnerability/GHSA-p6v2-xcpg-h6xw"}],"summary":"Better Auth: Rate limiter keys IPv6 addresses individually and is bypassable via prefix rotation"}