Is CVE-2026-45364 actively exploited?

No active exploitation of CVE-2026-45364 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-45364 be exploited remotely?

Yes. CVE-2026-45364 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-45364?

CVE-2026-45364 has a CVSS score of 7.3 (HIGH).

HOME VULNERABILITIESCVE-2026-45364

HIGH

CVE-2026-45364

CWE-307Published: May 28, 2026· Updated: Jun 1, 2026

7.3

CVSS v3.1

EPSS:0.07%probability of exploitation in 30 daysPercentile:21.5th

Official Description

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.4.17 and 1.5.0-beta.9, Better Auth's HTTP rate limiter keyed each request by the exact textual IP address it received in x-forwarded-for (or the configured IP-bearing header). IPv6 clients controlling a typical /64 allocation could rotate through 2^64 distinct source addresses without exhausting the per-address counter, defeating rate limiting on /sign-in/email, /sign-up/email, /forget-password, and every other path the limiter protects. The same bug allowed a single client to vary the textual encoding of one IPv6 address (uppercase, compression, IPv4-mapped, hex-encoded IPv4-in-IPv6) and produce multiple distinct keys. This vulnerability is fixed in 1.4.17 and 1.5.0-beta.9.

NVD Source

Technical Analysis

CVE-2026-45364 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.