Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit Bypass via Race Condition

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Oct 14, 2026 · NIST NVD

   Detected

   Better Auth @better-auth/drizzle-adapter and better-auth from 1.6.17 before 1.7.7, and @better-auth/kysely-adapter from 1.6.17 before 1.7.0, contain a race condition in database-backed rate limiting on PostgreSQL where the limit check is not atomic with the counter update. Remote attackers can send bursts of concurrent requests that pass the check together, exceeding configured limits on password

Affected

• vendor better-auth better-authversion unspecified
• vendor better-auth drizzle-adapterversion unspecified
• vendor better-auth kysely-adapterversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-110861

  Better Auth @better-auth/drizzle-adapter and better-auth from 1.6.17 before 1.7.7, and @better-auth/kysely-adapter from 1.6.17 before 1.7.0, contain a race condition in database-backed rate limiting on PostgreSQL where the limit check is not atomic with the counter update. Remote

  cve.org
• FIRST EPSSExploitation probabilityCVE-2026-110861

  30-day exploitation probability 0.2%

  first.org
• NIST NVDVulnerability recordCVE-2026-110861

  Better Auth @better-auth/drizzle-adapter and better-auth from 1.6.17 before 1.7.7, and @better-auth/kysely-adapter from 1.6.17 before 1.7.0, contain a race condition in database-backed rate limiting on PostgreSQL where the limit check is not atomic with the counter update. Remote

  nvd.nist.gov

References

• Reference · github.com
• Reference · vulncheck.com