{"items":[{"id":"NVI-00008869","kind":"vulnerability","title":"@better-auth/drizzle-adapter: Concurrent requests can exceed rate limits on PostgreSQL","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-44jh-23m7-hpcf","CVE-2026-110861"],"plain_summary":"GitHub lists this reviewed advisory for @better-auth/drizzle-adapter, @better-auth/kysely-adapter, better-auth. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-11b2c5c723d4c97ad29d28c4786aaa5e"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 1.7.7 for @better-auth/drizzle-adapter. Confirm the publisher’s latest guidance.","source_ids":["sr-9c0056a6101cc29e870dd58b4438b54d"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 1.7.0 for @better-auth/kysely-adapter. Confirm the publisher’s latest guidance.","source_ids":["sr-9c0056a6101cc29e870dd58b4438b54d"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 1.7.7 for better-auth. Confirm the publisher’s latest guidance.","source_ids":["sr-9c0056a6101cc29e870dd58b4438b54d"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-27T15:32:27.000Z","value":"3.7 low","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-11b2c5c723d4c97ad29d28c4786aaa5e"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-11b2c5c723d4c97ad29d28c4786aaa5e","url":"https://github.com/advisories/GHSA-44jh-23m7-hpcf","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-44jh-23m7-hpcf","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T21:56:51.534Z"},{"id":"sr-9c0056a6101cc29e870dd58b4438b54d","url":"https://github.com/advisories/GHSA-44jh-23m7-hpcf","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-44jh-23m7-hpcf","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-11-03T02:26:36.755Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-11b2c5c723d4c97ad29d28c4786aaa5e"],"technology":"@better-auth/drizzle-adapter","known_exclusions":[],"conditions_summary":"## Am I affected?\n\nYou are affected if you use `@better-auth/drizzle-adapter` from 1.6.17 through versions before 1.7.7 (including the 1.7.0 prereleases from beta.6 through rc.6) or `@better-auth/kysely-adapter` 1.6.17 through 1.6.31, and keep rate-limit records in a PostgreSQL database.\n\nAll of these must be true:\n\n- Rate limiting is enabled.\n- Rate-limit records are stored in the database.\n- The database is PostgreSQL, used through one of the adapter versions above.\n\nYou are not affected if you store rate-limit records in memory (the default) or in secondary storage.\n\n## Summary\n\nDatabase-backed rate limiting on PostgreSQL can let a burst of concurrent requests go over the configured maximum. When many requests arrive at the same time, several of them can pass the limit check together. This weakens the rate limit on password sign-in, two-factor verification, one-time codes, password resets, and other rate-limited endpoints.\n\n## Impact\n\nAn attacker who sends many requests at once can make more attempts than the application allows.\n\nThe issue does not bypass password or one-time-code validation. It does not directly compromise an account. The number of extra attempts is limited by ","public_affected_ranges":[">= 1.6.17, < 1.7.7"]},{"certainty":"source_listed","source_ids":["sr-11b2c5c723d4c97ad29d28c4786aaa5e"],"technology":"@better-auth/kysely-adapter","known_exclusions":[],"conditions_summary":"## Am I affected?\n\nYou are affected if you use `@better-auth/drizzle-adapter` from 1.6.17 through versions before 1.7.7 (including the 1.7.0 prereleases from beta.6 through rc.6) or `@better-auth/kysely-adapter` 1.6.17 through 1.6.31, and keep rate-limit records in a PostgreSQL database.\n\nAll of these must be true:\n\n- Rate limiting is enabled.\n- Rate-limit records are stored in the database.\n- The database is PostgreSQL, used through one of the adapter versions above.\n\nYou are not affected if you store rate-limit records in memory (the default) or in secondary storage.\n\n## Summary\n\nDatabase-backed rate limiting on PostgreSQL can let a burst of concurrent requests go over the configured maximum. When many requests arrive at the same time, several of them can pass the limit check together. This weakens the rate limit on password sign-in, two-factor verification, one-time codes, password resets, and other rate-limited endpoints.\n\n## Impact\n\nAn attacker who sends many requests at once can make more attempts than the application allows.\n\nThe issue does not bypass password or one-time-code validation. It does not directly compromise an account. The number of extra attempts is limited by ","public_affected_ranges":[">= 1.6.17, < 1.7.0"]},{"certainty":"source_listed","source_ids":["sr-11b2c5c723d4c97ad29d28c4786aaa5e"],"technology":"better-auth","known_exclusions":[],"conditions_summary":"## Am I affected?\n\nYou are affected if you use `@better-auth/drizzle-adapter` from 1.6.17 through versions before 1.7.7 (including the 1.7.0 prereleases from beta.6 through rc.6) or `@better-auth/kysely-adapter` 1.6.17 through 1.6.31, and keep rate-limit records in a PostgreSQL database.\n\nAll of these must be true:\n\n- Rate limiting is enabled.\n- Rate-limit records are stored in the database.\n- The database is PostgreSQL, used through one of the adapter versions above.\n\nYou are not affected if you store rate-limit records in memory (the default) or in secondary storage.\n\n## Summary\n\nDatabase-backed rate limiting on PostgreSQL can let a burst of concurrent requests go over the configured maximum. When many requests arrive at the same time, several of them can pass the limit check together. This weakens the rate limit on password sign-in, two-factor verification, one-time codes, password resets, and other rate-limited endpoints.\n\n## Impact\n\nAn attacker who sends many requests at once can make more attempts than the application allows.\n\nThe issue does not bypass password or one-time-code validation. It does not directly compromise an account. The number of extra attempts is limited by ","public_affected_ranges":[">= 1.6.17, < 1.7.7"]},{"certainty":"source_listed","source_ids":["sr-9c0056a6101cc29e870dd58b4438b54d"],"technology":"@better-auth/drizzle-adapter","known_exclusions":[],"conditions_summary":"## Am I affected?\n\nYou are affected if you use `@better-auth/drizzle-adapter` from 1.6.17 through versions before 1.7.7 (including the 1.7.0 prereleases from beta.6 through rc.6) or `@better-auth/kysely-adapter` 1.6.17 through 1.6.31, and keep rate-limit records in a PostgreSQL database.\n\nAll of these must be true:\n\n- Rate limiting is enabled.\n- Rate-limit records are stored in the database.\n- The database is PostgreSQL, used through one of the adapter versions above.\n\nYou are not affected if you store rate-limit records in memory (the default) or in secondary storage.\n\n## Summary\n\nDatabase-backed rate limiting on PostgreSQL can let a burst of concurrent requests go over the configured maximum. When many requests arrive at the same time, several of them can pass the limit check together. This weakens the rate limit on password sign-in, two-factor verification, one-time codes, password resets, and other rate-limited endpoints.\n\n## Impact\n\nAn attacker who sends many requests at once can make more attempts than the application allows.\n\nThe issue does not bypass password or one-time-code validation. It does not directly compromise an account. The number of extra attempts is limited by ","public_affected_ranges":["SEMVER: introduced 1.6.17; fixed 1.7.7"]},{"certainty":"source_listed","source_ids":["sr-9c0056a6101cc29e870dd58b4438b54d"],"technology":"@better-auth/kysely-adapter","known_exclusions":[],"conditions_summary":"## Am I affected?\n\nYou are affected if you use `@better-auth/drizzle-adapter` from 1.6.17 through versions before 1.7.7 (including the 1.7.0 prereleases from beta.6 through rc.6) or `@better-auth/kysely-adapter` 1.6.17 through 1.6.31, and keep rate-limit records in a PostgreSQL database.\n\nAll of these must be true:\n\n- Rate limiting is enabled.\n- Rate-limit records are stored in the database.\n- The database is PostgreSQL, used through one of the adapter versions above.\n\nYou are not affected if you store rate-limit records in memory (the default) or in secondary storage.\n\n## Summary\n\nDatabase-backed rate limiting on PostgreSQL can let a burst of concurrent requests go over the configured maximum. When many requests arrive at the same time, several of them can pass the limit check together. This weakens the rate limit on password sign-in, two-factor verification, one-time codes, password resets, and other rate-limited endpoints.\n\n## Impact\n\nAn attacker who sends many requests at once can make more attempts than the application allows.\n\nThe issue does not bypass password or one-time-code validation. It does not directly compromise an account. The number of extra attempts is limited by ","public_affected_ranges":["SEMVER: introduced 1.6.17; fixed 1.7.0"]},{"certainty":"source_listed","source_ids":["sr-9c0056a6101cc29e870dd58b4438b54d"],"technology":"better-auth","known_exclusions":[],"conditions_summary":"## Am I affected?\n\nYou are affected if you use `@better-auth/drizzle-adapter` from 1.6.17 through versions before 1.7.7 (including the 1.7.0 prereleases from beta.6 through rc.6) or `@better-auth/kysely-adapter` 1.6.17 through 1.6.31, and keep rate-limit records in a PostgreSQL database.\n\nAll of these must be true:\n\n- Rate limiting is enabled.\n- Rate-limit records are stored in the database.\n- The database is PostgreSQL, used through one of the adapter versions above.\n\nYou are not affected if you store rate-limit records in memory (the default) or in secondary storage.\n\n## Summary\n\nDatabase-backed rate limiting on PostgreSQL can let a burst of concurrent requests go over the configured maximum. When many requests arrive at the same time, several of them can pass the limit check together. This weakens the rate limit on password sign-in, two-factor verification, one-time codes, password resets, and other rate-limited endpoints.\n\n## Impact\n\nAn attacker who sends many requests at once can make more attempts than the application allows.\n\nThe issue does not bypass password or one-time-code validation. It does not directly compromise an account. The number of extra attempts is limited by ","public_affected_ranges":["SEMVER: introduced 1.6.17; fixed 1.7.7"]}],"null_published_at":"2026-11-03T22:39:43.352Z","source_updated_at":"2026-10-27T15:32:27.000Z","source_disclosed_at":"2026-10-27T15:32:25.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-10-31T21:56:51.534Z"},{"id":"NVI-00008869","kind":"vulnerability","title":"@better-auth/drizzle-adapter: Concurrent requests can exceed rate limits on PostgreSQL","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-44jh-23m7-hpcf"],"plain_summary":"GitHub lists this reviewed advisory for @better-auth/drizzle-adapter, @better-auth/kysely-adapter, better-auth. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-11b2c5c723d4c97ad29d28c4786aaa5e"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-27T15:32:27.000Z","value":"3.7 low","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-11b2c5c723d4c97ad29d28c4786aaa5e"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-11b2c5c723d4c97ad29d28c4786aaa5e","url":"https://github.com/advisories/GHSA-44jh-23m7-hpcf","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-44jh-23m7-hpcf","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T21:56:51.534Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-11b2c5c723d4c97ad29d28c4786aaa5e"],"technology":"@better-auth/drizzle-adapter","known_exclusions":[],"conditions_summary":"## Am I affected?\n\nYou are affected if you use `@better-auth/drizzle-adapter` from 1.6.17 through versions before 1.7.7 (including the 1.7.0 prereleases from beta.6 through rc.6) or `@better-auth/kysely-adapter` 1.6.17 through 1.6.31, and keep rate-limit records in a PostgreSQL database.\n\nAll of these must be true:\n\n- Rate limiting is enabled.\n- Rate-limit records are stored in the database.\n- The database is PostgreSQL, used through one of the adapter versions above.\n\nYou are not affected if you store rate-limit records in memory (the default) or in secondary storage.\n\n## Summary\n\nDatabase-backed rate limiting on PostgreSQL can let a burst of concurrent requests go over the configured maximum. When many requests arrive at the same time, several of them can pass the limit check together. This weakens the rate limit on password sign-in, two-factor verification, one-time codes, password resets, and other rate-limited endpoints.\n\n## Impact\n\nAn attacker who sends many requests at once can make more attempts than the application allows.\n\nThe issue does not bypass password or one-time-code validation. It does not directly compromise an account. The number of extra attempts is limited by ","public_affected_ranges":[">= 1.6.17, < 1.7.7"]},{"certainty":"source_listed","source_ids":["sr-11b2c5c723d4c97ad29d28c4786aaa5e"],"technology":"@better-auth/kysely-adapter","known_exclusions":[],"conditions_summary":"## Am I affected?\n\nYou are affected if you use `@better-auth/drizzle-adapter` from 1.6.17 through versions before 1.7.7 (including the 1.7.0 prereleases from beta.6 through rc.6) or `@better-auth/kysely-adapter` 1.6.17 through 1.6.31, and keep rate-limit records in a PostgreSQL database.\n\nAll of these must be true:\n\n- Rate limiting is enabled.\n- Rate-limit records are stored in the database.\n- The database is PostgreSQL, used through one of the adapter versions above.\n\nYou are not affected if you store rate-limit records in memory (the default) or in secondary storage.\n\n## Summary\n\nDatabase-backed rate limiting on PostgreSQL can let a burst of concurrent requests go over the configured maximum. When many requests arrive at the same time, several of them can pass the limit check together. This weakens the rate limit on password sign-in, two-factor verification, one-time codes, password resets, and other rate-limited endpoints.\n\n## Impact\n\nAn attacker who sends many requests at once can make more attempts than the application allows.\n\nThe issue does not bypass password or one-time-code validation. It does not directly compromise an account. The number of extra attempts is limited by ","public_affected_ranges":[">= 1.6.17, < 1.7.0"]},{"certainty":"source_listed","source_ids":["sr-11b2c5c723d4c97ad29d28c4786aaa5e"],"technology":"better-auth","known_exclusions":[],"conditions_summary":"## Am I affected?\n\nYou are affected if you use `@better-auth/drizzle-adapter` from 1.6.17 through versions before 1.7.7 (including the 1.7.0 prereleases from beta.6 through rc.6) or `@better-auth/kysely-adapter` 1.6.17 through 1.6.31, and keep rate-limit records in a PostgreSQL database.\n\nAll of these must be true:\n\n- Rate limiting is enabled.\n- Rate-limit records are stored in the database.\n- The database is PostgreSQL, used through one of the adapter versions above.\n\nYou are not affected if you store rate-limit records in memory (the default) or in secondary storage.\n\n## Summary\n\nDatabase-backed rate limiting on PostgreSQL can let a burst of concurrent requests go over the configured maximum. When many requests arrive at the same time, several of them can pass the limit check together. This weakens the rate limit on password sign-in, two-factor verification, one-time codes, password resets, and other rate-limited endpoints.\n\n## Impact\n\nAn attacker who sends many requests at once can make more attempts than the application allows.\n\nThe issue does not bypass password or one-time-code validation. It does not directly compromise an account. The number of extra attempts is limited by ","public_affected_ranges":[">= 1.6.17, < 1.7.7"]}],"null_published_at":"2026-10-31T22:13:27.120Z","source_updated_at":"2026-10-27T15:32:27.000Z","source_disclosed_at":"2026-10-27T15:32:25.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T21:56:51.534Z"}],"next_cursor":null,"snapshot_revision":"42594"}