The vulnerability is in Better Auth’s HTTP rate limiter, which keys requests by the raw textual IP address in the x-forwarded-for or configured header. IPv6 clients can manipulate the address within a /64 prefix or use different textual representations to generate distinct keys, allowing them to perform unlimited authentication attempts on protected endpoints such as sign‑in, sign‑up, and forget‑password. The CVE describes this as an "Improper Restriction of Excessive Authentication Attempts" (CWE‑307) weakness that can enable unauthorized access. The description does not explicitly mention denial of service or resource exhaustion; these effects are inferred but not directly stated.

Better Auth library versions before 1.4.17 and 1.5.0‑beta.9 are affected; the flaw applies to any application that uses the library’s HTTP rate limiter for authentication and authorization handling.

The vulnerability has a CVSS score of 7.3, indicating high severity. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog. Attackers can exploit the defect remotely by controlling an IPv6 address, thereby rotating through up to 2^64 distinct addresses or using different textual formats to evade the limiter. This allows brute‑force credential attempts against the application without requiring local privileges.