{"id":"CVE-2026-110861","revision":"1d66b316358c4a389bae5a95e8d2623b","records":[{"revision":"1d66b316358c4a389bae5a95e8d2623b","observedAt":"2026-10-27T16:45:50.731+00:00","statement":{"source":"nvd","id":"CVE-2026-110861","aliases":[],"title":"Better Auth @better-auth/drizzle-adapter and better-auth from 1.6.17 before 1.7.7, and @better-auth/kysely-adapter from 1.6.17 before 1.7.0, contain a race condition in database-backed rate limiting on PostgreSQL where the limit check is no…","description":"Better Auth @better-auth/drizzle-adapter and better-auth from 1.6.17 before 1.7.7, and @better-auth/kysely-adapter from 1.6.17 before 1.7.0, contain a race condition in database-backed rate limiting on PostgreSQL where the limit check is not atomic with the counter update. Remote attackers can send bursts of concurrent requests that pass the check together, exceeding configured limits on password sign-in, two-factor verification, one-time code, password reset, and other rate-limited endpoints.","state":0,"publishedAt":"2026-10-14T23:17:27.49+00:00","modifiedAt":"2026-10-20T03:17:14.297+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · disclosure@vulncheck.com · Secondary","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":6.3,"severity":"MEDIUM"},{"system":"CVSS 3.1 · disclosure@vulncheck.com · Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","score":3.7,"severity":"LOW"}],"references":["https://github.com/better-auth/better-auth/security/advisories/GHSA-44jh-23m7-hpcf","https://www.vulncheck.com/advisories/better-auth-drizzle-adapter-1.6.17-before-1.7.7-rate-limit-bypass-via-race-condition"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110861","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Awaiting Analysis","weaknesses":["CWE-307"],"productCriteria":[],"sourceDates":{"published":"2026-10-14T23:17:27.490","lastModified":"2026-10-20T03:17:14.297"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-110861","identifiers":["CVE-2026-110861"]},"retained":false,"historicalAffected":[]}],"coverage":[]}