Search

Find a vulnerability

Search criteria

    2 vulnerabilities found for drizzle-adapter by better-auth

    CVE-2026-110861 (GCVE-0-2026-110861)

    Vulnerability from nvd – Published: 2026-10-14 22:52 – Updated: 2026-10-14 22:52
    VLAI
    Title
    Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit Bypass via Race Condition
    Summary
    Better Auth @better-auth/drizzle-adapter and better-auth from 1.6.17 before 1.7.7, and @better-auth/kysely-adapter from 1.6.17 before 1.7.0, contain a race condition in database-backed rate limiting on PostgreSQL where the limit check is not atomic with the counter update. Remote attackers can send bursts of concurrent requests that pass the check together, exceeding configured limits on password sign-in, two-factor verification, one-time code, password reset, and other rate-limited endpoints.
    Severity
    6.3 (Medium)
    CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
    3.7 (Low)
    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
    CWE
    • CWE-307 - Improper Restriction of Excessive Authentication Attempts
    Assigner
    VulnCheck CNA under the mitre root
    CNA scorecard B 84/100 over 6373 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    better-auth drizzle-adapter Affected: 1.6.17 , < 1.7.7 (semver)
    Unaffected: 1.7.7 (semver)
    		Create a notification for this product.
    better-auth kysely-adapter Affected: 1.6.17 , < 1.7.0 (semver)
    Unaffected: 1.7.0 (semver)
    		Create a notification for this product.
    better-auth better-auth Affected: 1.6.17 , < 1.7.7 (semver)
    Unaffected: 1.7.7 (semver)
    		Create a notification for this product.
    Date Public
    2026-09-30 00:00
    Credits
    designorant
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/%40better-auth/drizzle-adapter",
          "product": "drizzle-adapter",
          "vendor": "better-auth",
          "versions": [
            {
              "lessThan": "1.7.7",
              "status": "affected",
              "version": "1.6.17",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.7.7",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/%40better-auth/kysely-adapter",
          "product": "kysely-adapter",
          "vendor": "better-auth",
          "versions": [
            {
              "lessThan": "1.7.0",
              "status": "affected",
              "version": "1.6.17",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.7.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/better-auth",
          "product": "better-auth",
          "vendor": "better-auth",
          "versions": [
            {
              "lessThan": "1.7.7",
              "status": "affected",
              "version": "1.6.17",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.7.7",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:better-auth:better_auth:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.7.7",
                  "versionStartIncluding": "1.6.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "designorant"
        }
      ],
      "datePublic": "2026-09-30T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Better Auth @better-auth/drizzle-adapter and better-auth from 1.6.17 before 1.7.7, and @better-auth/kysely-adapter from 1.6.17 before 1.7.0, contain a race condition in database-backed rate limiting on PostgreSQL where the limit check is not atomic with the counter update. Remote attackers can send bursts of concurrent requests that pass the check together, exceeding configured limits on password sign-in, two-factor verification, one-time code, password reset, and other rate-limited endpoints."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-307",
              "description": "Improper Restriction of Excessive Authentication Attempts",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T22:52:45.713Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-44jh-23m7-hpcf)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-44jh-23m7-hpcf"
        },
        {
          "name": "VulnCheck Advisory: Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit Bypass via Race Condition",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/better-auth-drizzle-adapter-1.6.17-before-1.7.7-rate-limit-bypass-via-race-condition"
        }
      ],
      "title": "Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit Bypass via Race Condition",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-110861",
    "datePublished": "2026-10-14T22:52:45.713Z",
    "dateReserved": "2026-10-14T22:18:33.239Z",
    "dateUpdated": "2026-10-14T22:52:45.713Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-110861 (GCVE-0-2026-110861)

    Vulnerability from cvelistv5 – Published: 2026-10-14 22:52 – Updated: 2026-10-14 22:52
    VLAI
    Title
    Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit Bypass via Race Condition
    Summary
    Better Auth @better-auth/drizzle-adapter and better-auth from 1.6.17 before 1.7.7, and @better-auth/kysely-adapter from 1.6.17 before 1.7.0, contain a race condition in database-backed rate limiting on PostgreSQL where the limit check is not atomic with the counter update. Remote attackers can send bursts of concurrent requests that pass the check together, exceeding configured limits on password sign-in, two-factor verification, one-time code, password reset, and other rate-limited endpoints.
    Severity
    6.3 (Medium)
    CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
    3.7 (Low)
    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
    CWE
    • CWE-307 - Improper Restriction of Excessive Authentication Attempts
    Assigner
    VulnCheck CNA under the mitre root
    CNA scorecard B 84/100 over 6373 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    better-auth drizzle-adapter Affected: 1.6.17 , < 1.7.7 (semver)
    Unaffected: 1.7.7 (semver)
    		Create a notification for this product.
    better-auth kysely-adapter Affected: 1.6.17 , < 1.7.0 (semver)
    Unaffected: 1.7.0 (semver)
    		Create a notification for this product.
    better-auth better-auth Affected: 1.6.17 , < 1.7.7 (semver)
    Unaffected: 1.7.7 (semver)
    		Create a notification for this product.
    Date Public
    2026-09-30 00:00
    Credits
    designorant
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/%40better-auth/drizzle-adapter",
          "product": "drizzle-adapter",
          "vendor": "better-auth",
          "versions": [
            {
              "lessThan": "1.7.7",
              "status": "affected",
              "version": "1.6.17",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.7.7",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/%40better-auth/kysely-adapter",
          "product": "kysely-adapter",
          "vendor": "better-auth",
          "versions": [
            {
              "lessThan": "1.7.0",
              "status": "affected",
              "version": "1.6.17",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.7.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/better-auth",
          "product": "better-auth",
          "vendor": "better-auth",
          "versions": [
            {
              "lessThan": "1.7.7",
              "status": "affected",
              "version": "1.6.17",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.7.7",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:better-auth:better_auth:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.7.7",
                  "versionStartIncluding": "1.6.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "designorant"
        }
      ],
      "datePublic": "2026-09-30T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Better Auth @better-auth/drizzle-adapter and better-auth from 1.6.17 before 1.7.7, and @better-auth/kysely-adapter from 1.6.17 before 1.7.0, contain a race condition in database-backed rate limiting on PostgreSQL where the limit check is not atomic with the counter update. Remote attackers can send bursts of concurrent requests that pass the check together, exceeding configured limits on password sign-in, two-factor verification, one-time code, password reset, and other rate-limited endpoints."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-307",
              "description": "Improper Restriction of Excessive Authentication Attempts",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T22:52:45.713Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-44jh-23m7-hpcf)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-44jh-23m7-hpcf"
        },
        {
          "name": "VulnCheck Advisory: Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit Bypass via Race Condition",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/better-auth-drizzle-adapter-1.6.17-before-1.7.7-rate-limit-bypass-via-race-condition"
        }
      ],
      "title": "Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit Bypass via Race Condition",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-110861",
    "datePublished": "2026-10-14T22:52:45.713Z",
    "dateReserved": "2026-10-14T22:18:33.239Z",
    "dateUpdated": "2026-10-14T22:52:45.713Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}