Description
Better Auth @better-auth/drizzle-adapter and better-auth from 1.6.17 before 1.7.7, and @better-auth/kysely-adapter from 1.6.17 before 1.7.0, contain a race condition in database-backed rate limiting on PostgreSQL where the limit check is not atomic with the counter update. Remote attackers can send bursts of concurrent requests that pass the check together, exceeding configured limits on password sign-in, two-factor verification, one-time code, password reset, and other rate-limited endpoints.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
better-auth drizzle-adapter
Default version status: unaffected
1.6.17 to < 1.7.7affected1.7.7unaffected
pkg:npm/%40better-auth/drizzle-adapterbetter-auth kysely-adapter
Default version status: unaffected
1.6.17 to < 1.7.0affected1.7.0unaffected
pkg:npm/%40better-auth/kysely-adapterbetter-auth better-auth
Default version status: unaffected
1.6.17 to < 1.7.7affected1.7.7unaffected
pkg:npm/better-auth