From dcc289e49d3c447e4a842aed6124f2b941723cde Mon Sep 17 00:00:00 2001
From: Taesu <166604494+bytaesu@users.noreply.github.com>
Date: Wed, 28 Jan 2026 16:37:12 +0900
Subject: [PATCH] fix(email-otp): add stricter default rate limits for password
 reset endpoints (#7658)

---
 .../src/plugins/email-otp/index.ts            | 21 +++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/packages/better-auth/src/plugins/email-otp/index.ts b/packages/better-auth/src/plugins/email-otp/index.ts
index 21f106121b..374f8588f3 100644
--- a/packages/better-auth/src/plugins/email-otp/index.ts
+++ b/packages/better-auth/src/plugins/email-otp/index.ts
@@ -141,6 +141,27 @@ export const emailOTP = (options: EmailOTPOptions) => {
 				window: 60,
 				max: 3,
 			},
+			{
+				pathMatcher(path) {
+					return path === "/email-otp/request-password-reset";
+				},
+				window: 60,
+				max: 3,
+			},
+			{
+				pathMatcher(path) {
+					return path === "/email-otp/reset-password";
+				},
+				window: 60,
+				max: 3,
+			},
+			{
+				pathMatcher(path) {
+					return path === "/forget-password/email-otp";
+				},
+				window: 60,
+				max: 3,
+			},
 		],
 		options,
 	} satisfies BetterAuthPlugin;