Vigie VulnDBEuropean-hosted Vulnerability DB

CVE-2026-110861

Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit Bypass via Race Condition

At a glance

Severity
MEDIUM 6.3
EPSS
EPSS 0.22 % · percentile 12 (2026-10-27)
State
PUBLISHED
Published
Updated
Assigner
VulnCheck
NVD status
Awaiting Analysis

Description

Better Auth @better-auth/drizzle-adapter and better-auth from 1.6.17 before 1.7.7, and @better-auth/kysely-adapter from 1.6.17 before 1.7.0, contain a race condition in database-backed rate limiting on PostgreSQL where the limit check is not atomic with the counter update. Remote attackers can send bursts of concurrent requests that pass the check together, exceeding configured limits on password sign-in, two-factor verification, one-time code, password reset, and other rate-limited endpoints.

Scores

VersionScoreVectorScored by
CVSS 4.0MEDIUM 6.3CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:NVulnCheck
CVSS 3.1LOW 3.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:NVulnCheck
CVSS 4.0MEDIUM 6.3CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XNVD · disclosure@vulncheck.com (Secondary)
CVSS 3.1LOW 3.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:NNVD · disclosure@vulncheck.com (Secondary)

Weaknesses (CWE)

Advisories

European references

Affected products

ProductVersions
better-auth · drizzle-adapteraffected 1.6.17 < 1.7.7 ; unaffected 1.7.7
better-auth · kysely-adapteraffected 1.6.17 < 1.7.0 ; unaffected 1.7.0
better-auth · better-authaffected 1.6.17 < 1.7.7 ; unaffected 1.7.7

References

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD