Skip to content
Heist/ feed
Back to feed
Medium

Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit Bypass via Race Condition

Type: advisorySources: OSV

Better Auth @better-auth/drizzle-adapter and better-auth from 1.6.17 before 1.7.7, and @better-auth/kysely-adapter from 1.6.17 before 1.7.0, contain a race condition in database-backed rate limiting on PostgreSQL where the limit check is not atomic with the counter update. Remote attackers can send bursts of concurrent requests that pass the check together, exceeding configured limits on password sign-in, two-factor verification, one-time code, password reset, and other rate-limited endpoints.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-110861
Confirmed fixed CVEs
Not specified
Updated in this feed
4 Nov 2026, 08:05 UTC · Revision 1

Source evidence

Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit Bypass via Race Condition

core-osv · Original source

Published 14 Oct 2026, 22:52 UTC

Better Auth @better-auth/drizzle-adapter and better-auth from 1.6.17 before 1.7.7, and @better-auth/kysely-adapter from 1.6.17 before 1.7.0, contain a race condition in database-backed rate limiting on PostgreSQL where the limit check is not atomic with the counter update. Remote attackers can send bursts of concurrent requests that pass the check together, exceeding configured limits on password sign-in, two-factor verification, one-time code, password reset, and other rate-limited endpoints.

osv:CVE-2026-110861
Complete source record
{
  "id": "e46395b24a7b20aed157884703df51e286af8a61bd98fb4bec0619147b62411c",
  "url": "https://osv.dev/vulnerability/CVE-2026-110861",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit Bypass via Race Condition",
    "summary": "Better Auth @better-auth/drizzle-adapter and better-auth from 1.6.17 before 1.7.7, and @better-auth/kysely-adapter from 1.6.17 before 1.7.0, contain a race condition in database-backed rate limiting on PostgreSQL where the limit check is not atomic with the counter update. Remote attackers can send bursts of concurrent requests that pass the check together, exceeding configured limits on password sign-in, two-factor verification, one-time code, password reset, and other rate-limited endpoints.",
    "evidence": "osv:CVE-2026-110861",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2026-110861",
      "aliases": [
        "CVE-2026-110861",
        "GHSA-44jh-23m7-hpcf"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/better-auth/better-auth",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0d8b238acc13da34d6769bb413d407b1356703fc"
                },
                {
                  "fixed": "db02f233918ad1233bf0753e437e1c0da353273d"
                },
                {
                  "fixed": "c3688ba88edff12dfcb1ced007e332711509ac29"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "1.6.17"
                      },
                      {
                        "fixed": "1.7.7"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  },
                  {
                    "range": [
                      {
                        "introduced": "1.6.17"
                      },
                      {
                        "fixed": "1.7.0"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v1.6.30",
            "v1.6.29",
            "v1.6.28",
            "v1.6.27",
            "v1.6.26",
            "v1.6.25",
            "v1.6.24",
            "v1.6.23",
            "v1.6.22",
            "v1.6.21",
            "v1.6.20",
            "v1.6.19",
            "v1.6.18",
            "v1.6.17"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110861.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:33.621445268Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110861.json",
        "https://github.com/better-auth/better-auth/security/advisories/GHSA-44jh-23m7-hpcf",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-110861",
        "https://www.vulncheck.com/advisories/better-auth-drizzle-adapter-1.6.17-before-1.7.7-rate-limit-bypass-via-race-condition"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-307"
        ],
        "cna_assigner": "VulnCheck",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110861.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-110861",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 501056,
  "published_at": "2026-10-14T22:52:45.713+00:00"
}