CVE-2026-110861: Improper Restriction of Excessive Authentication Attempts in better-auth drizzle-adapter

The vulnerability CVE-2026-110861 affects better-auth packages (@better-auth/drizzle-adapter and @better-auth/kysely-adapter) in specified versions. It is caused by a race condition in the database-backed rate limiting mechanism on PostgreSQL, where the check for rate limits is not performed atomically with the update of the request counter. This allows multiple concurrent requests to pass the limit check simultaneously, effectively bypassing the configured rate limits on various authentication-related endpoints.

Attackers can exploit this race condition to send bursts of concurrent authentication requests that exceed the intended rate limits. This could lead to increased risk of brute force or credential stuffing attacks on password sign-in, two-factor authentication, one-time code verification, and password reset functionalities. However, the CVSS score of 6.3 and the medium severity rating indicate that exploitation requires some conditions such as high attack complexity and partial attack prerequisites.

The vulnerability affects versions >=1.6.17 and <1.7.7 for drizzle-adapter and >=1.6.17 and <1.7.0 for kysely-adapter. Users should upgrade to versions 1.7.7 or later for drizzle-adapter and 1.7.0 or later for kysely-adapter where this race condition is fixed. No vendor advisory content was provided to indicate otherwise. Patch status is confirmed by the version ranges indicating fixed versions. Applying these updates will mitigate the risk.