GHSA-44jh-23m7-hpcfPublished
Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit Bypass via Race Condition
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-110861 · Microsoft / collected KEV context
cve-program · CVE-2026-110861
- https://github.com/better-auth/better-auth/security/advisories/GHSA-44jh-23m7-hpcf
- https://www.vulncheck.com/advisories/better-auth-drizzle-adapter-1.6.17-before-1.7.7-rate-limit-bypass-via-race-condition
euvd · EUVD-2026-101744
- https://github.com/better-auth/better-auth/security/advisories/GHSA-44jh-23m7-hpcf
- https://www.vulncheck.com/advisories/better-auth-drizzle-adapter-1.6.17-before-1.7.7-rate-limit-bypass-via-race-condition
nvd · CVE-2026-110861
- https://github.com/better-auth/better-auth/security/advisories/GHSA-44jh-23m7-hpcf
- https://www.vulncheck.com/advisories/better-auth-drizzle-adapter-1.6.17-before-1.7.7-rate-limit-bypass-via-race-condition
osv · GHSA-44jh-23m7-hpcf
- https://github.com/better-auth/better-auth/security/advisories/GHSA-44jh-23m7-hpcf
- https://github.com/better-auth/better-auth/pull/11331
- https://github.com/better-auth/better-auth/commit/35d7cd389220f99cfc98ac699e6a42b48313a740
- https://github.com/better-auth/better-auth
- https://github.com/better-auth/better-auth/releases/tag/v1.7.7
Related operational evidence
Explicit CVE identifiers- @better-auth/drizzle-adapter: Concurrent requests can exceed rate limits on PostgreSQL · Newly collected advisory · 27 Oct 2026