CVE-2026-110861: Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit Bypass via Race Condition
Better Auth @better-auth/drizzle-adapter and better-auth from 1.6.17 before 1.7.7, and @better-auth/kysely-adapter from 1.6.17 before 1.7.0, contain a race condition in database-backed rate limiting on PostgreSQL where the limit check is not atomic with the counter update. Remote attackers can send bursts of concurrent requests that pass the check together, exceeding configured limits on password sign-in, two-factor verification, one-time code, password reset, and other rate-limited endpoints.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
better-authto a version that resolves this vulnerability.Fixed in 1.7.7 - Upgrade
Upgrade
@better-auth/drizzle-adapterto a version that resolves this vulnerability.Fixed in 1.7.7 - Upgrade
Upgrade
@better-auth/kysely-adapterto a version that resolves this vulnerability.Fixed in 1.7.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using database-backed rate limiting on PostgreSQL are affected if they use better-auth or @better-auth/drizzle-adapter from 1.6.17 before 1.7.7, or @better-auth/kysely-adapter from 1.6.17 before 1.7.0.
What must an attacker do to bypass the configured limit?
An unauthenticated remote attacker must send a burst of concurrent requests. The race condition allows multiple requests to pass the database-backed limit check before the counter updates.
Which functions can be impacted by the bypass?
Affected rate-limited endpoints include password sign-in, two-factor verification, one-time code processing, and password reset. Other endpoints using the same database-backed rate-limiting behavior may also be affected.
Does exploitation require credentials or user interaction?
No. The supplied vector indicates that exploitation requires neither privileges nor user interaction, but it has high attack complexity because the attacker must successfully trigger the race with concurrent requests.