CVE-2026-110861 better-auth CVE debrief

Who should care

Defenders responsible for systems using Better Auth drizzle-adapter, kysely-adapter, and better-auth should assess exposure and prioritize verification and potential updates. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify exposure and consider updates to affected packages.

Why it matters

CVE-2026-110861 is a medium-severity vulnerability in Better Auth drizzle-adapter and kysely-adapter, and better-auth, allowing remote attackers to bypass rate limiting on PostgreSQL. Defenders should prioritize verifying exposure and assessing the impact on their systems.

• Remote attackers can bypass rate limiting, potentially leading to increased traffic on rate-limited endpoints.
• Defenders need to verify exposure and assess the impact on their systems.
• Updates to affected packages may be necessary to mitigate the vulnerability.

Technical summary

The Better Auth drizzle-adapter and kysely-adapter, and better-auth from 1.6.17 before 1.7.7, contain a race condition in database-backed rate limiting on PostgreSQL. This allows remote attackers to send bursts of concurrent requests that pass the check together, exceeding configured limits on password sign-in, two-factor verification, one-time code, password reset, and other rate-limited endpoints.

Defensive priority

Defenders should prioritize verifying exposure and assessing the impact of this vulnerability on their systems, especially those using the affected packages.

Recommended defensive actions

• Verify the versions of Better Auth drizzle-adapter, kysely-adapter, and better-auth in use and assess exposure.
• Update to version 1.7.7 or later for drizzle-adapter and better-auth, and to version 1.7.0 or later for kysely-adapter.
• Monitor for bursts of concurrent requests that may exploit the rate limiting bypass.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and references to vendor advisories. The Better Auth drizzle-adapter, kysely-adapter, and better-auth packages are impacted. Evidence limits suggest verifying exposure and assessing the impact on systems using these packages. Defenders should review vendor advisories and consider updates to affected packages.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.