MEDIUM 6.3 NVD
CVE-2026-110861
Better Auth @better-auth/drizzle-adapter and better-auth from 1.6.17 before 1.7.7, and @better-auth/kysely-adapter from 1.6.17 before 1.7.0, contain a race cond
Better Auth @better-auth/drizzle-adapter and better-auth from 1.6.17 before 1.7.7, and @better-auth/kysely-adapter from 1.6.17 before 1.7.0, contain a race condition in database-backed rate limiting on PostgreSQL where the limit check is not atomic with the counter update. Remote attackers can send bursts of concurrent requests that pass the check together, exceeding configured limits on password sign-in, two-factor verification, one-time code, password reset, and other rate-limited endpoints.
References
- https://github.com/better-auth/better-auth/security/advisories/GHSA-44jh-23m7-hpcf
- https://www.vulncheck.com/advisories/better-auth-drizzle-adapter-1.6.17-before-1.7.7-rate-
This medium severity vulnerability with a CVSS score of 6.3 was published on 2026-10-14 via NVD.
vulnfeed aggregates 15100 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.