Better Auth EUVD-2026-101744

Requires the target to use Better Auth's database-backed rate limiting with a PostgreSQL store on an affected version (better-auth/@better-auth/drizzle-adapter 1.6.17-1.7.6, or @better-auth/kysely-adapter 1.6.17 before 1.7.0), and rate limiting must be enabled on the targeted endpoints (password sign-in, two-factor verification, one-time code, password reset). Exploitation further depends on the attacker achieving genuine request concurrency within the narrow check-then-update window - reflected in AC:H/AT:P - so server-side request serialization, low connection concurrency, or an external throttle (WAF/reverse-proxy rate limit) materially limits success. No special authentication is required (PR:N), but the impact is bounded to defeating throttling rather than direct data or system compromise.

This is a moderate-severity integrity/control weakness, not a high-urgency flaw. The single provided scoring signal is a CVSS 4.0 base vector (6.3, AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N): network-reachable and pre-authentication (PR:N), but with high attack complexity (AC:H) and a present attack requirement (AT:P) that reflects the race-window timing/concurrency needed to win the TOCTOU condition. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or at-scale exploitation; the signals are mutually consistent (a timing-dependent logic flaw scored at only Low confidentiality impact), not conflicting. The practical risk is that this flaw erodes a security control (rate limiting) rather than granting direct code execution or data access - its danger is as a force-multiplier for brute-force/credential-stuffing against sign-in, 2FA, OTP, and password-reset endpoints. Net priority: patch in the normal cycle for internet-facing deployments on PostgreSQL, elevated if those auth endpoints are high-value, but it does not warrant emergency response on the data provided. Note the input 'Information Disclosure' tag overstates impact - this is a rate-limit bypass (CWE-307), with only incidental confidentiality exposure through successful brute force.

An attacker scripts many concurrent authentication attempts against a vulnerable Better Auth deployment on PostgreSQL, firing bursts so that multiple requests read the rate-limit counter before any of them writes the increment, letting far more attempts through than the configured limit. By repeatedly bursting, they brute-force or credential-stuff password sign-in, 2FA codes, or one-time codes well beyond intended throttling. No public exploit code was identified at time of analysis, and the narrow race window (AC:H/AT:P) makes reliable exploitation timing-sensitive.