TI-2026-41960 Aliases CVE-2026-58269 GHSA-92cr-jxw4-5wjg

Sync-in Server has a complete 2FA Bypass via `POST /api/auth/token`

HIGH 70CWE-288Published 2026-09-21 · Updated 2026-09-24

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-288.

Summary

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, `POST /api/auth/token` authenticates with username and password only, then calls `getTokens()`, which returns full access and refresh JWTs without checking whether the account has TOTP 2FA enabled. An attacker with stolen or phished credentials can bypass 2FA in a single request. The parallel login endpoint (`POST /api/auth/login`) correctly enforces 2FA by calling `setCookies(user, res, true)`, which gates on `user.twoFaEnabled`. Version 2.4.0 patches the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00274 19th percentileScored 2026-11-07

Fix Fixed server (Sync-in): 2.4.0@sync-in/server (npm): 2.4.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Sync-in	server	before 2.4.0	2.4.0	Patch available	CNA
—	@sync-in/server (npm)	before 2.4.0	2.4.0	Patch available	GHSA-92cr-jxw4-5wjg

server VendorSync-in Affected before 2.4.0 Fixed in 2.4.0 Patch available CNA
@sync-in/server (npm) Vendor— Affected before 2.4.0 Fixed in 2.4.0 Patch available GHSA-92cr-jxw4-5wjg

Remediation

Fix · CNA server (Sync-in) Fixed in 2.4.0
Fix · GHSA-92cr-jxw4-5wjg @sync-in/server (npm) Fixed in 2.4.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-58269
2026-10-03 Alias added: GHSA-92cr-jxw4-5wjg

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-58269

Other 5

TI-2026-29787 Username Enumeration via Timing Attack CVSS 4.0MEDIUM 6.9
TI-2026-35188 Sync-in Server: SSRF protection bypass via IPv4-mapped IPv6 addresses in regExpPrivateIP CVSS 3.1HIGH 7.7
TI-2026-41962 @sync-in/server vulnerable to TOTP Brute-Force via `POST /api/app/sync/register` CVSS 3.1MEDIUM 6.8
TI-2026-41963 Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST… CVSS 3.1MEDIUM 5.3
TI-2026-41961 Sync-in Server has a ReDoS via Unsanitized Regex in Sync Diff `pathFilters` CVSS 3.1MEDIUM 6.5
TI-2025-41214 A Stored Cross-Site Scripting (XSS) vulnerability in Sync-in Server before 1.9.3 allows… CVSS 3.1MEDIUM 6.1

See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences