@better-auth/drizzle-adapter: Concurrent Requests Can Exceed Rate Limits On PostgreSQL

Am I affected? You are affected if you use "@better-auth/drizzle-adapter" from 1.6.17 through versions before 1.7.7 including the 1.7.0 prereleases from beta.6 through rc.6 or "@better-auth/kysely-adapter" 1.6.17 through 1.6.31, and keep rate-limit records in a PostgreSQL database. All of these...

npm: @better-auth/drizzle-adapter: Concurrent requests can exceed rate limits on PostgreSQL

npm: @better-auth/drizzle-adapter: Concurrent requests can exceed rate limits on PostgreSQL vulnerability discovered by ? in WordPress npm better-auth versions = 1.6.17, 1.7.7...

GHSA-44JH-23M7-HPCF @better-auth/drizzle-adapter: Concurrent requests can exceed rate limits on PostgreSQL

Am I affected? You are affected if you use @better-auth/drizzle-adapter from 1.6.17 through versions before 1.7.7 including the 1.7.0 prereleases from beta.6 through rc.6 or @better-auth/kysely-adapter 1.6.17 through 1.6.31, and keep rate-limit records in a PostgreSQL database. All of these must ...

@abiyz/identity (>=0.2.0, <=0.2.6), @adaptcom/server (>=0.1.0-next-20260909201057, <=0.1.0-next-20260911225825) +340 more potentially affected by unknown CVE via @better-auth/drizzle-adapter (>=1.6.17, <=1.7.6)

@better-auth/drizzle-adapter NPM version =1.6.17, =0.2.0, =0.1.0-next-20260909201057, =0.0.0-beta-20260819155526, =0.0.0-beta-20260819155526, =0.0.7, =0.1.10, =0.12.0, =0.28.0, =0.1.1, =1.0.0, =1.4.4, =1.4.7 - @arxen/access-control 0.2.0 - @arxen/cli 0.2.0 - @arxen/core 0.2.0 and more Source cves...

@abiyz/identity (>=0.2.0, <=0.2.6), @adaptcom/server (>=0.1.0-next-20260909201057, <=0.1.0-next-20260911225825) +340 more potentially affected by CVE-2026-110861 via @better-auth/drizzle-adapter (>=1.6.17, <=1.7.6)

@better-auth/drizzle-adapter NPM version =1.6.17, =0.2.0, =0.1.0-next-20260909201057, =0.0.0-beta-20260819155526, =0.0.0-beta-20260819155526, =0.0.7, =0.1.10, =0.12.0, =0.28.0, =0.1.1, =1.0.0, =1.4.4, =1.4.7 - @arxen/access-control 0.2.0 - @arxen/cli 0.2.0 - @arxen/core 0.2.0 and more Source cves...

@better-auth/drizzle-adapter: Concurrent requests can exceed rate limits on PostgreSQL

Am I affected? You are affected if you use @better-auth/drizzle-adapter from 1.6.17 through versions before 1.7.7 including the 1.7.0 prereleases from beta.6 through rc.6 or @better-auth/kysely-adapter 1.6.17 through 1.6.31, and keep rate-limit records in a PostgreSQL database. All of these must ...

@abiyz/identity (>=0.2.0, <=0.2.6), @adaptcom/server (>=0.1.0-next-20260909201057, <=0.1.0-next-20260911225825) +340 more potentially affected by CVE-2026-110861 via @better-auth/drizzle-adapter (>=1.6.17, <=1.7.6)

@better-auth/drizzle-adapter NPM version =1.6.17, =0.2.0, =0.1.0-next-20260909201057, =0.0.0-beta-20260819155526, =0.0.0-beta-20260819155526, =0.0.7, =0.1.10, =0.12.0, =0.28.0, =0.1.1, =1.0.0, =1.4.4, =1.4.7 - @arxen/access-control 0.2.0 - @arxen/cli 0.2.0 - @arxen/core 0.2.0 and more Source cves...

Brute Force

Overview @better-auth/drizzle-adapter is a Drizzle adapter for Better Auth Affected versions of this package are vulnerable to Brute Force via a race condition in the compare-and-swap UPDATE path in drizzle-adapter.ts and relations-v2/index.ts. Under PostgreSQL's READ COMMITTED isolation, the WHE...

CVE-2026-110861 Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit Bypass via Race Condition

Better Auth @better-auth/drizzle-adapter and better-auth from 1.6.17 before 1.7.7, and @better-auth/kysely-adapter from 1.6.17 before 1.7.0, contain a race condition in database-backed rate limiting on PostgreSQL where the limit check is not atomic with the counter update. Remote attackers can se...

CVE-2026-110861 Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit Bypass via Race Condition

Better Auth @better-auth/drizzle-adapter and better-auth from 1.6.17 before 1.7.7, and @better-auth/kysely-adapter from 1.6.17 before 1.7.0, contain a race condition in database-backed rate limiting on PostgreSQL where the limit check is not atomic with the counter update. Remote attackers can se...

CVE-2026-110861 Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit Bypass via Race Condition

Better Auth @better-auth/drizzle-adapter and better-auth from 1.6.17 before 1.7.7, and @better-auth/kysely-adapter from 1.6.17 before 1.7.0, contain a race condition in database-backed rate limiting on PostgreSQL where the limit check is not atomic with the counter update. Remote attackers can se...

CVE-2026-110861

The Better Auth library, specifically the @better-auth/drizzle-adapter (versions 1.6.17 to 1.7.7), better-auth (versions 1.6.17 to 1.7.7), and @better-auth/kysely-adapter (versions 1.6.17 to 1.7.0), contains a race condition in its database-backed rate limiting when used with PostgreSQL . The roo...

@abiyz/identity (>=0.2.0, <=0.2.6), @adaptcom/server (>=0.1.0-next-20260909201057, <=0.1.0-next-20260911225825) +204 more potentially affected by CVE-2026-110861 via @better-auth/drizzle-adapter (>=1.7.0, <=1.7.6)

@better-auth/drizzle-adapter NPM version =1.7.0, =0.2.0, =0.1.0-next-20260909201057, =0.180.0-nightly-20260915112218, =0.2.726-nightly-20260915112218, =0.1.10, =0.12.0, =1.4.4, =0.1.0, =0.1.0, =0.0.7, =0.9.28, =0.9.136, =0.6.202, =0.9.131, =0.9.190 and more Source cves: CVE-2026-110861 Source...

PT-2026-114175

Name of the Vulnerable Software and Affected Versions better-auth versions 1.6.17 through 1.7.6 @better-auth/drizzle-adapter versions 1.6.17 through 1.7.6 @better-auth/kysely-adapter versions 1.6.17 through 1.6.9 Description A race condition exists in database-backed rate limiting on PostgreSQL...

Payload CMS 3.72.0 - Blind SQL Injection

Exploit Title: Payload CMS 3.72.0 - Blind SQL Injection Google Dork: N/A Date: 2026-08-01 Exploit Author: cardosource Vendor Homepage: https://payloadcms.com/ Software Link: https://github.com/payloadcms/payload Version: requests.Response: url: str = "http://localhost:3000/api/posts"...

Payload CMS 3.72.0 SQL Injection

Payload CMS version 3.72.0 suffers from a remote blind SQL injection vulnerability. Exploit Title: Payload CMS 3.72.0 - Blind SQL Injection Google Dork: N/A Date: 2026-08-01 Exploit Author: cardosource Vendor Homepage: https://payloadcms.com/ Software Link: https://github.com/payloadcms/payload...

SQL Injection

Overview @payloadcms/db-d1-sqlite is a The officially supported D1 SQLite database adapter for Payload Affected versions of this package are vulnerable to SQL Injection when querying JSON or richText fields. An attacker can extract sensitive information and gain unauthorized access to user accoun...

SQL Injection

Overview @payloadcms/db-vercel-postgres is a Vercel Postgres adapter for Payload Affected versions of this package are vulnerable to SQL Injection when querying JSON or richText fields. An attacker can extract sensitive information and gain unauthorized access to user accounts by injecting crafte...