What’s Vulnerable › Vulnerabilities

CVE-2026-110861: Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit Bypass via Race Condition

• Severity: low (CVSS 3.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-14 · updated 2026-10-20
• Weakness: CWE-307

Description

Better Auth @better-auth/drizzle-adapter and better-auth from 1.6.17 before 1.7.7, and @better-auth/kysely-adapter from 1.6.17 before 1.7.0, contain a race condition in database-backed rate limiting on PostgreSQL where the limit check is not atomic with the counter update. Remote attackers can send bursts of concurrent requests that pass the check together, exceeding configured limits on password sign-in, two-factor verification, one-time code, password reset, and other rate-limited endpoints.

Affected products

• Npm @Better-Auth/Drizzle-Adapter: from 1.6.17 before 1.7.7 — fixed in 1.7.7
• Npm @Better-Auth/Kysely-Adapter: from 1.6.17 before 1.7.0 — fixed in 1.7.0
• Npm Better-Auth: from 1.6.17 before 1.7.7 — fixed in 1.7.7
• better-auth: from 1.6.17 before 1.7.7 — fixed in 1.7.7
• better-auth drizzle-adapter: from 1.6.17 before 1.7.7 — fixed in 1.7.7
• better-auth kysely-adapter: from 1.6.17 before 1.7.0 — fixed in 1.7.0

How to fix

Upgrade to a fixed version: Npm @Better-Auth/Drizzle-Adapter 1.7.7; Npm @Better-Auth/Kysely-Adapter 1.7.0; Npm Better-Auth 1.7.7; better-auth 1.7.7; better-auth drizzle-adapter 1.7.7; better-auth kysely-adapter 1.7.0. Check the vendor advisory for mitigations.

References

• https://github.com/better-auth/better-auth/security/advisories/GHSA-44jh-23m7-hpcf
• https://www.vulncheck.com/advisories/better-auth-drizzle-adapter-1.6.17-before-1.7.7-rate-limit-bypass-via-race-condition

Get alerted when CVE-2026-110861 or the next vulnerability affects your stack