CVE-2026-110861: drizzle-adapter 1.6.17 to before 1.7.7; +2 more affected products

Affected technology

drizzle-adapter · 1.6.17 to before 1.7.7
better-auth

kysely-adapter · 1.6.17 to before 1.7.0
better-auth

better-auth · 1.6.17 to before 1.7.7
better-auth

Description’s affected range: before 1.7.7, and @better-auth/kysely-adapter from 1.6.17 before 1.7.0,

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Remote attackers can send bursts of concurrent requests that pass the check together, exceeding configured limits on password sign-in, two-factor verification, one-time code, password reset, and other rate-limited endpoints. Vendor/CNA’s CVSS 4.0 assessment (base score 6.3/10) rates confidentiality impact as low; integrity and availability impact as none.