Vulnerability · Published Oct 14, 2026 · Assigned by VulnCheck
CVE-2026-110861Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit Bypass via Race Condition
Low 3.7
In plain English
A low-severity security flaw in better-auth from better-auth. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Better Auth @better-auth/drizzle-adapter and better-auth from 1.6.17 before 1.7.7, and @better-auth/kysely-adapter from 1.6.17 before 1.7.0, contain a race condition in database-backed rate limiting on PostgreSQL where the limit check is not atomic with the counter update. Remote attackers can send bursts of concurrent requests that pass the check together, exceeding configured limits on password sign-in, two-factor verification, one-time code, password reset, and other rate-limited endpoints.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | @better-auth/drizzle-adapter | 1.7.7 | GHSA-44jh-23m7-hpcf |
| npm | @better-auth/kysely-adapter | 1.7.0 | GHSA-44jh-23m7-hpcf |
| npm | better-auth | 1.7.7 | GHSA-44jh-23m7-hpcf |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| better-auth | drizzle-adapter | 1.6.17 – before 1.7.7 |
| better-auth | kysely-adapter | 1.6.17 – before 1.7.0 |
| better-auth | better-auth | 1.6.17 – before 1.7.7 |
Weakness: CWE-307 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N