CVE-2026-110861: medium-severity vulnerability in better-auth drizzle-adapter
Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit Bypass via Race Condition
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.3epss 0.2%
Better Auth @better-auth/drizzle-adapter and better-auth from 1.6.17 before 1.7.7, and @better-auth/kysely-adapter from 1.6.17 before 1.7.0, contain a race condition in database-backed rate limiting on PostgreSQL where the limit check is not atomic with the counter update. Remote attackers can send bursts of concurrent requests that pass the check together, exceeding configured limits on password sign-in, two-factor verification, one-time code, password reset, and other rate-limited endpoints.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Related CVEs — better-auth drizzle-adapter
In the same product, most dangerous first.
CVE-2025-61928CRITICALBetter Auth: Unauthenticated API key creation through api-key pluginEPSS 19.7%CVE-2025-71404MEDIUMbetter-auth before 1.1.16 Reflected XSS via error parameterEPSS 0.7%CVE-2025-71399HIGHBetter Auth before 1.4.5 Path Normalization Bypass via rou3EPSS 0.5%CVE-2026-67337HIGHbetter-auth before 1.4.9 Two-Factor Authentication Bypass via session.cookieCacheEPSS 0.5%CVE-2025-71401CRITICALbetter-auth before 1.4.2 basePath Modification DoSEPSS 0.5%CVE-2026-67327HIGHbetter-auth before 1.6.22 Account Takeover via Magic-Link Email-OTPEPSS 0.4%