npm: @better-auth/drizzle-adapter: Concurrent requests can exceed rate limits on PostgreSQL

npm: @better-auth/drizzle-adapter: Concurrent requests can exceed rate limits on PostgreSQL vulnerability discovered by ? in WordPress npm better-auth versions = 1.6.17, 1.7.7...

GHSA-44JH-23M7-HPCF @better-auth/drizzle-adapter: Concurrent requests can exceed rate limits on PostgreSQL

Am I affected? You are affected if you use @better-auth/drizzle-adapter from 1.6.17 through versions before 1.7.7 including the 1.7.0 prereleases from beta.6 through rc.6 or @better-auth/kysely-adapter 1.6.17 through 1.6.31, and keep rate-limit records in a PostgreSQL database. All of these must ...

@better-auth/drizzle-adapter: Concurrent requests can exceed rate limits on PostgreSQL

Am I affected? You are affected if you use @better-auth/drizzle-adapter from 1.6.17 through versions before 1.7.7 including the 1.7.0 prereleases from beta.6 through rc.6 or @better-auth/kysely-adapter 1.6.17 through 1.6.31, and keep rate-limit records in a PostgreSQL database. All of these must ...

@abiyz/identity (>=0.2.0, <=0.2.5), @adaptcom/server (>=0.1.0-next-20260909201057, <=0.1.0-next-20260911225825) +350 more potentially affected by CVE-2026-110861 via @better-auth/drizzle-adapter (>=1.6.17, <=1.7.6)

@better-auth/drizzle-adapter NPM version =1.6.17, =0.2.0, =0.1.0-next-20260909201057, =0.0.0-beta-20260819155526, =0.0.0-beta-20260819155526, =0.0.7, =0.1.10, =0.12.0, =0.28.0, =0.1.1, =1.0.0, =1.4.4, =1.4.7 - @arxen/access-control 0.2.0 - @arxen/cli 0.2.0 - @arxen/core 0.2.0 - @arxen/governance...

Brute Force

Overview @better-auth/kysely-adapter is a Kysely adapter for Better Auth Affected versions of this package are vulnerable to Brute Force via a race condition in the compare-and-swap UPDATE path in drizzle-adapter.ts and relations-v2/index.ts. Under PostgreSQL's READ COMMITTED isolation, the WHERE...

Brute Force

Overview better-auth is a The most comprehensive authentication library for TypeScript. Affected versions of this package are vulnerable to Brute Force via a race condition in the compare-and-swap UPDATE path in drizzle-adapter.ts and relations-v2/index.ts. Under PostgreSQL's READ COMMITTED...

Brute Force

Overview @better-auth/drizzle-adapter is a Drizzle adapter for Better Auth Affected versions of this package are vulnerable to Brute Force via a race condition in the compare-and-swap UPDATE path in drizzle-adapter.ts and relations-v2/index.ts. Under PostgreSQL's READ COMMITTED isolation, the WHE...

CVE-2026-110861 Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit Bypass via Race Condition

Better Auth @better-auth/drizzle-adapter and better-auth from 1.6.17 before 1.7.7, and @better-auth/kysely-adapter from 1.6.17 before 1.7.0, contain a race condition in database-backed rate limiting on PostgreSQL where the limit check is not atomic with the counter update. Remote attackers can se...

CVE-2026-110861 Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit Bypass via Race Condition

Better Auth @better-auth/drizzle-adapter and better-auth from 1.6.17 before 1.7.7, and @better-auth/kysely-adapter from 1.6.17 before 1.7.0, contain a race condition in database-backed rate limiting on PostgreSQL where the limit check is not atomic with the counter update. Remote attackers can se...

CVE-2026-110861 Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit Bypass via Race Condition

Better Auth @better-auth/drizzle-adapter and better-auth from 1.6.17 before 1.7.7, and @better-auth/kysely-adapter from 1.6.17 before 1.7.0, contain a race condition in database-backed rate limiting on PostgreSQL where the limit check is not atomic with the counter update. Remote attackers can se...

@abiyz/identity (>=0.2.0, <=0.2.5), @adaptcom/server (>=0.1.0-next-20260909201057, <=0.1.0-next-20260911225825) +212 more potentially affected by CVE-2026-110861 via @better-auth/drizzle-adapter (>=1.7.0, <=1.7.6)

@better-auth/drizzle-adapter NPM version =1.7.0, =0.2.0, =0.1.0-next-20260909201057, =0.180.0-nightly-20260915112218, =0.2.726-nightly-20260915112218, =0.1.10, =0.12.0, =1.4.4, =0.1.0, =0.1.0, =0.0.7, =0.9.28, =0.9.136, =0.6.202, =0.9.131, =0.9.3, =0.9.167 and more Source cves: CVE-2026-110861...

CVE-2026-110861

The Better Auth library, specifically the @better-auth/drizzle-adapter (versions 1.6.17 to 1.7.7), better-auth (versions 1.6.17 to 1.7.7), and @better-auth/kysely-adapter (versions 1.6.17 to 1.7.0), contains a race condition in its database-backed rate limiting when used with PostgreSQL . The roo...

PT-2026-114175

Name of the Vulnerable Software and Affected Versions better-auth versions 1.6.17 through 1.7.6 @better-auth/drizzle-adapter versions 1.6.17 through 1.7.6 @better-auth/kysely-adapter versions 1.6.17 through 1.6.9 Description A race condition exists in database-backed rate limiting on PostgreSQL...

Overly Restrictive Account Lockout Mechanism

Overview @payloadcms/drizzle is an A library of shared functions used by different payload database adapters Affected versions of this package are vulnerable to Overly Restrictive Account Lockout Mechanism via the resetPassword operation, which fails to reset the account lockout state upon a...

@adenta/cms (>=0.0.6, <=1.1.1-0), @ainsleydev/payload-helper (>=0.0.6, <=0.3.2) +37 more potentially affected by CVE-2026-105866 via @payloadcms/drizzle (>=3.0.0-beta.74, <=3.89.0)

@payloadcms/drizzle NPM version =3.0.0-beta.74, =0.0.6, =0.0.6, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =3.22.1, =3.37.0, =1.0.0, =1.2.0 and more Source cves: CVE-2026-105866 Source advisory: SNYK:JS-PAYLOADCMSDRIZZLE-20570507...

@payloadcms/db-d1-sqlite (>=4.0.0-canary.0, <=4.0.0-canary.33), @payloadcms/db-postgres (>=4.0.0-canary.0, <=4.0.0-canary.33) +2 more potentially affected by CVE-2026-105866 via @payloadcms/drizzle (>=4.0.0-canary.0, <=4.0.0-canary.33)

@payloadcms/drizzle NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.33 Source cves: CVE-2026-105866 Source advisory: SNYK:JS-PAYLOADCMSDRIZZLE-20570507...

@payloadcms/db-d1-sqlite (>=4.0.0-canary.0, <=4.0.0-canary.33), @payloadcms/db-postgres (>=4.0.0-canary.0, <=4.0.0-canary.33) +2 more potentially affected by CVE-2026-105856 via @payloadcms/drizzle (>=4.0.0-canary.0, <=4.0.0-canary.33)

@payloadcms/drizzle NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.33 Source cves: CVE-2026-105856 Source advisory: MEND:CVE-2026-105856...

@adenta/cms (>=0.0.6, <=1.1.1-0), @ainsleydev/payload-helper (>=0.0.25, <=0.3.2) +37 more potentially affected by CVE-2026-105856 via @payloadcms/drizzle (>=3.0.0, <=3.89.0)

@payloadcms/drizzle NPM version =3.0.0, =0.0.6, =0.0.25, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =3.22.1, =3.37.0, =1.0.0, =1.2.0 and more Source cves: CVE-2026-105856 Source advisory: MEND:CVE-2026-105856...

Missing Authorization

Overview @payloadcms/drizzle is an A library of shared functions used by different payload database adapters Affected versions of this package are vulnerable to Missing Authorization via the contains query operator on relationship, upload, and join fields, where access control filters injected fo...

@adenta/cms (>=0.0.6, <=1.1.1-0), @ainsleydev/payload-helper (>=0.0.6, <=0.3.2) +37 more potentially affected by CVE-2026-105852 via @payloadcms/drizzle (>=3.0.0-beta.74, <=3.89.0)

@payloadcms/drizzle NPM version =3.0.0-beta.74, =0.0.6, =0.0.6, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =3.22.1, =3.37.0, =1.0.0, =1.2.0 and more Source cves: CVE-2026-105852 Source advisory: SNYK:JS-PAYLOADCMSDRIZZLE-20571386...