CVE-2026-110861

Awaiting Analysis Awaiting Analysis - Queue

Race Condition in Better Auth PostgreSQL Rate Limiting

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: VulnCheck

Description

Better Auth @better-auth/drizzle-adapter and better-auth from 1.6.17 before 1.7.7, and @better-auth/kysely-adapter from 1.6.17 before 1.7.0, contain a race condition in database-backed rate limiting on PostgreSQL where the limit check is not atomic with the counter update. Remote attackers can send bursts of concurrent requests that pass the check together, exceeding configured limits on password sign-in, two-factor verification, one-time code, password reset, and other rate-limited endpoints.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110861

EUVD

EUVD-2026-101744

Affected Vendors & Products

Vendor	Product	Version / Range
better-auth	drizzle-adapter	1.6.17
better-auth	kysely-adapter	1.6.17
better-auth	better-auth	1.6.17

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-307	The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

Attack-Flow Graph

Executive Summary

This vulnerability is a race condition in Better Auth's database-backed rate limiting for PostgreSQL. The issue occurs when the limit check and counter update are not performed atomically. Attackers can exploit this by sending bursts of concurrent requests that bypass the rate limit together, allowing them to exceed configured limits on sensitive endpoints like password sign-in or password reset.

Detection Guidance

This vulnerability involves a race condition in database-backed rate limiting for PostgreSQL. Detection requires checking if your system uses Better Auth versions 1.6.17 to 1.7.7 or related adapters. Review application logs for rate-limited endpoints like sign-in or password reset for unusual concurrent request patterns. No specific commands are provided in the context.

Impact Analysis

This vulnerability could allow attackers to bypass rate limits on critical authentication endpoints. This might lead to brute force attacks on passwords, one-time codes, or password resets, potentially enabling unauthorized account access or denial of service due to excessive requests.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized access through rate-limiting bypasses. Exceeding password sign-in or two-factor verification limits may violate authentication security requirements under these regulations.

Mitigation Strategies

Upgrade to patched versions: better-auth to 1.7.7 or later, @better-auth/drizzle-adapter to 1.7.7 or later, and @better-auth/kysely-adapter to 1.7.0 or later. Review rate-limiting configurations to ensure atomic checks and updates in PostgreSQL.

Hi! I’m here to help you understand CVE-2026-110861. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70