@BETTER-AUTH/KYSELY-ADAPTER · GHSA-48c2-w96j-mv3m · Package
FIX → 1.8.0-beta.5 +1
On MySQL or MariaDB with generateId set to serial, the adapter read the new row's ID through a separate query that could run on a different pooled connection. A signed-in user can receive another user's session or sign-up record and act as that user.
first public Nov 3, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that use better-auth with the Kysely or Drizzle adapter, a MySQL or MariaDB database, and advanced.database.generateId: "serial" are exposed. Deployments on PostgreSQL, SQLite or other ID settings are not affected, and the advisory says a single-connection pool does not prevent the flaw.
Not affected if default-id-generation, postgresql, sqlite
Who cares better-auth, drizzle, kysely, mariadb, mysql, node.js
You are affected if all of these are true:
advanced.database.generateId: "serial".You are not affected with other databases or other ID settings.
After inserting a row, the adapter read the new ID back with a separate query. On a connection pool, that query could run on a different connection and return the ID of a row inserted by another request.
Under ordinary concurrent load, a user who signs in can receive another user's session and act as that user. A sign-up can also return another user's record. Other requests fail with an error. The attacker cannot choose which account they receive.
Upgrade better-auth and your adapter package (@better-auth/kysely-adapter or @better-auth/drizzle-adapter) to 1.7.16, or to 1.8.0-beta.5 on the beta line.
If you cannot upgrade, stop using generateId: "serial" on MySQL. A single-connection pool does not prevent this.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
better-auth, @better-auth/kysely-adapter and @better-auth/drizzle-adapter (for example npm ls better-auth @better-auth/kysely-adapter @better-auth/drizzle-adapter).generateId: "serial" and confirm the database is MySQL or MariaDB.Upgrade to 1.8.0-beta.5 +1
better-auth 1.7.16 (or 1.8.0-beta.5 on the beta line)@better-auth/kysely-adapter 1.7.16 (or 1.8.0-beta.5 on the beta line)@better-auth/drizzle-adapter 1.7.16 (or 1.8.0-beta.5 on the beta line)generateId: "serial" on MySQL; a single-connection pool does not prevent this.The MySQL branch ran the insert on the pool and then read LAST_INSERT_ID() in a separate transaction. LAST_INSERT_ID() is scoped to a connection, so the second query could see another request's insert. The adapters now use the ID reported by the insert itself, and fail instead of guessing when no ID is reported.