CVE-2026-110861

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-110861
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110861.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-110861
Aliases
  • GHSA-44jh-23m7-hpcf
Published
2026-10-14T22:52:45Z
Modified
2026-10-15T10:47:35Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit Bypass via Race Condition
Details

Better Auth @better-auth/drizzle-adapter and better-auth from 1.6.17 before 1.7.7, and @better-auth/kysely-adapter from 1.6.17 before 1.7.0, contain a race condition in database-backed rate limiting on PostgreSQL where the limit check is not atomic with the counter update. Remote attackers can send bursts of concurrent requests that pass the check together, exceeding configured limits on password sign-in, two-factor verification, one-time code, password reset, and other rate-limited endpoints.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-307"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110861.json"
}
References

Affected packages

Git / github.com/better-auth/better-auth

Affected ranges

Type
GIT
Repo
https://github.com/better-auth/better-auth
Events
Introduced
0d8b238acc13da34d6769bb413d407b1356703fc
Fixed
db02f233918ad1233bf0753e437e1c0da353273d
Fixed
c3688ba88edff12dfcb1ced007e332711509ac29
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "1.6.17"
        },
        {
            "fixed":  "1.7.7"
        },
        {
            "fixed":  "1.7.0"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

v1.*
v1.6.17
v1.6.18
v1.6.19
v1.6.20
v1.6.21
v1.6.22
v1.6.23
v1.6.24
v1.6.25
v1.6.26
v1.6.27
v1.6.28
v1.6.29
v1.6.30

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110861.json"