# CVE-2026-110861: @better-auth/drizzle-adapter: Concurrent requests can exceed rate limits on PostgreSQL

Source: https://junglewise.ai/threats/cve-2026-110861-better-auth-better-auth-drizzle-adapter-and-better-auth-from-1-6  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-14  
License: CC BY 4.0 with a link back

CVE-2026-110861 · Severity: low · CVSS 3.7 · Published 2026-10-14

Better Auth @better-auth/drizzle-adapter and better-auth from 1.6.17 before 1.7.7, and @better-auth/kysely-adapter from 1.6.17 before 1.7.0, contain a race condition in database-backed rate limiting on PostgreSQL where the limit check is not atomic with the counter update. Remote attackers can send bursts of concurrent requests that pass the check together, exceeding configured limits on password sign-in, two-factor verification, one-time code, password reset, and other rate-limited endpoints.

Technologies: [better-auth (npm)](https://junglewise.ai/threats/technologies/better-auth). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-110861 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-110861 being exploited in the wild.

**How severe is CVE-2026-110861?** Low severity, with a CVSS score of 3.7, published 14 October 2026.

**Which products and versions are affected?** @better-auth/drizzle-adapter (npm) SEMVER:introduced=1.6.17,fixed=1.7.7; @better-auth/kysely-adapter (npm) SEMVER:introduced=1.6.17,fixed=1.7.0; better-auth (npm) SEMVER:introduced=1.6.17,fixed=1.7.7.

**Is there a fix for CVE-2026-110861?** Yes. @better-auth/drizzle-adapter (npm): upgrade to 1.7.7 or later; @better-auth/kysely-adapter (npm): upgrade to 1.7.0 or later; better-auth (npm): upgrade to 1.7.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2026-110861?** Check whether you run @better-auth/drizzle-adapter (npm), @better-auth/kysely-adapter (npm) or better-auth (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @better-auth/drizzle-adapter (npm): upgrade to 1.7.7 or later

  ```sh
  npm install @better-auth/drizzle-adapter@1.7.7
  ```

- @better-auth/kysely-adapter (npm): upgrade to 1.7.0 or later

  ```sh
  npm install @better-auth/kysely-adapter@1.7.0
  ```

- better-auth (npm): upgrade to 1.7.7 or later

  ```sh
  npm install better-auth@1.7.7
  ```


## Affected products

- @better-auth/drizzle-adapter (npm) SEMVER:introduced=1.6.17,fixed=1.7.7
- @better-auth/kysely-adapter (npm) SEMVER:introduced=1.6.17,fixed=1.7.0
- better-auth (npm) SEMVER:introduced=1.6.17,fixed=1.7.7

## Identifiers

- CVE-2026-110861
- GHSA-44jh-23m7-hpcf

## Related threats

- [Better Auth authentication bypass in Magic Link and OAuth](https://junglewise.ai/threats/cve-2026-114607-better-auth-is-an-authentication-and-authorization-library-for)
- [Better Auth OAuth Proxy authentication bypass](https://junglewise.ai/threats/cve-2026-110864-better-auth-from-1-5-0-beta-12-before-1-7-7-contains-an)
- [Better Auth authentication bypass via OAuth state reuse](https://junglewise.ai/threats/cve-2026-110862-better-auth-from-1-4-0-beta-18-before-1-7-7-contains-an)
- [better-auth device authorization UI misrepresentation in deviceAuthorization plugin](https://junglewise.ai/threats/cve-2026-109346-better-auth-from-1-3-8-beta-3-before-1-7-0-rc-3-contains-a-ui)
- [better-auth external request basePath modification DoS](https://junglewise.ai/threats/better-auth-external-request-basepath-modification-dos-644481c4)