CVE-2026-110861

Full vulnerability record from the local CVENow database.

Description

Better Auth @better-auth/drizzle-adapter and better-auth from 1.6.17 before 1.7.7, and @better-auth/kysely-adapter from 1.6.17 before 1.7.0, contain a race condition in database-backed rate limiting on PostgreSQL where the limit check is not atomic with the counter update. Remote attackers can send bursts of concurrent requests that pass the check together, exceeding configured limits on password sign-in, two-factor verification, one-time code, password reset, and other rate-limited endpoints.

Severity

MEDIUM

CVSS score

6.3 (v4.0)

Vulnerability status

Awaiting Analysis

Source identifier

[email protected]

Published

2026-10-14 23:17:27.490000

Last modified

2026-10-20 03:17:14.297000

View original CVE JSON

{
  "id": "CVE-2026-110861",
  "sourceIdentifier": "[email protected]",
  "published": "2026-10-14T23:17:27.490",
  "lastModified": "2026-10-20T03:17:14.297",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Better Auth @better-auth/drizzle-adapter and better-auth from 1.6.17 before 1.7.7, and @better-auth/kysely-adapter from 1.6.17 before 1.7.0, contain a race condition in database-backed rate limiting on PostgreSQL where the limit check is not atomic with the counter update. Remote attackers can send bursts of concurrent requests that pass the check together, exceeding configured limits on password sign-in, two-factor verification, one-time code, password reset, and other rate-limited endpoints."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "better-auth",
          "product": "drizzle-adapter",
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/%40better-auth/drizzle-adapter",
          "versions": [
            {
              "version": "1.6.17",
              "lessThan": "1.7.7",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "1.7.7",
              "versionType": "semver",
              "status": "unaffected"
            }
          ]
        },
        {
          "vendor": "better-auth",
          "product": "kysely-adapter",
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/%40better-auth/kysely-adapter",
          "versions": [
            {
              "version": "1.6.17",
              "lessThan": "1.7.0",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "1.7.0",
              "versionType": "semver",
              "status": "unaffected"
            }
          ]
        },
        {
          "vendor": "better-auth",
          "product": "better-auth",
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/better-auth",
          "versions": [
            {
              "version": "1.6.17",
              "lessThan": "1.7.7",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "1.7.7",
              "versionType": "semver",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 6.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "LOW",
          "vulnIntegrityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "baseScore": 3.7,
          "baseSeverity": "LOW",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-10-20T02:26:21.724147Z",
          "id": "CVE-2026-110861",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-307"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-44jh-23m7-hpcf",
      "source": "[email protected]"
    },
    {
      "url": "https://www.vulncheck.com/advisories/better-auth-drizzle-adapter-1.6.17-before-1.7.7-rate-limit-bypass-via-race-condition",
      "source": "[email protected]"
    }
  ]
}