Race Condition Vulnerability in Better Auth Product by Better Auth

CVE-2026-110861

What is CVE-2026-110861?

The Better Auth products suffer from a race condition related to database-backed rate limiting on PostgreSQL. This vulnerability arises because the limit check operation is not atomic with the counter update, allowing remote attackers to exploit this weakness. Through concurrent request bursts, an attacker can manipulate the system to bypass standard limit checks on multiple endpoints such as password sign-in, two-factor verification, and password reset functionalities, essentially exceeding the configured security thresholds.

References