Better Auth @better-auth/drizzle-adapter and better-auth from 1.6.17 before 1.7.7, and @better-auth/kysely-adapter from 1.6.17 before 1.7.0, contain a race condition in database-backed rate limiting on PostgreSQL where the limit check is not atomic with the counter update. Remote attackers can send bursts of concurrent requests that pass the check together, exceeding configured limits on password sign-in, two-factor verification, one-time code, password reset, and other rate-limited endpoints.
Metrics
Affected Vendors & Products
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Wed, 14 Oct 2026 23:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Better Auth @better-auth/drizzle-adapter and better-auth from 1.6.17 before 1.7.7, and @better-auth/kysely-adapter from 1.6.17 before 1.7.0, contain a race condition in database-backed rate limiting on PostgreSQL where the limit check is not atomic with the counter update. Remote attackers can send bursts of concurrent requests that pass the check together, exceeding configured limits on password sign-in, two-factor verification, one-time code, password reset, and other rate-limited endpoints. | |
| Title | Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit Bypass via Race Condition | |
| First Time appeared |
Better-auth
Better-auth better Auth |
|
| Weaknesses | CWE-307 | |
| CPEs | cpe:2.3:a:better-auth:better_auth:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Better-auth
Better-auth better Auth |
|
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published:
Updated: 2026-10-14T22:52:45.713Z
Reserved: 2026-10-14T22:18:33.239Z
Link: CVE-2026-110861
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-14T23:17:27.490
Modified: 2026-10-14T23:17:27.490
Link: CVE-2026-110861
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses