All vulnerabilities
CVE-2026-110861GHSA-44jh-23m7-hpcf

Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit Bypass via Race Condition

better-auth drizzle-adapter
Open in ThreatlineRecord JSON
CVSS
6.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.22%Chance of exploitation activity in the next 30 days, higher than 11% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.7.7Also 1.7.0CVE List
Published14 Oct 2026Updated 20 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Better Auth @better-auth/drizzle-adapter and better-auth from 1.6.17 before 1.7.7, and @better-auth/kysely-adapter from 1.6.17 before 1.7.0, contain a race condition in database-backed rate limiting on PostgreSQL where the limit check is not atomic with the counter update. Remote attackers can send bursts of concurrent requests that pass the check together, exceeding configured limits on password sign-in, two-factor verification, one-time code, password reset, and other rate-limited endpoints.

Text from CVE List

Affected versions 6

  • drizzle-adapteraffected: 1.6.17 before 1.7.7CVE List
  • drizzle-adapterunaffected: 1.7.7CVE List
  • kysely-adapteraffected: 1.6.17 before 1.7.0CVE List
  • kysely-adapterunaffected: 1.7.0CVE List
  • better-authaffected: 1.6.17 before 1.7.7CVE List
  • better-authunaffected: 1.7.7CVE List

References 2