The vulnerability is a race condition in database‑backed rate limiting: the check for a quota limit is not performed atomically with the counter increment. As a result, remote attackers can issue many concurrent requests that all pass the limit check before the counter is updated, allowing repeated access to authentication endpoints that should be throttled. This can facilitate brute‑force password attempts, enable continuous two‑factor verification requests, and generally undermine the protective intent of rate limits on sign‑in, reset, and one‑time code routes.

The affected products are the package better‑auth and its adapters drizzle‑adapter and kysely‑adapter, originating from the better‑auth ecosystem. Vulnerable versions are 1.6.17 through 1.7.6 for drizzle‑adapter and 1.6.17 through 1.6.9 for kysely‑adapter. The issue is present on the PostgreSQL back‑end used by these adapters.

The CVSS score of 6.3 classifies this as medium severity; the EPSS score is not available, and the vulnerability is not listed in CISA KEV. Attackers can trigger the race condition by sending bursts of concurrent HTTP requests to any exposed rate‑limited authentication endpoint, which is a typical network‑based attack vector. Successful exploitation allows attackers to bypass configured limits, increasing their chances of guessing credentials or generating excessive one‑time codes, and may also lead to denial of service by overloading authentication resources.