TI-2026-41962 Aliases CVE-2026-58271 GHSA-274f-6w77-8qm9

@sync-in/server vulnerable to TOTP Brute-Force via `POST /api/app/sync/register`

HIGH 65CWE-307Published 2026-09-21 · Updated 2026-09-24

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: High
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-307.

Summary

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, `POST /api/app/sync/register` accepts credentials and a TOTP code to register a desktop sync client. On a failed TOTP, `SyncClientsManager.register()` calls `updateAccesses(user, ip, false)`, which hits a freeze branch that writes `passwordAttempts` back unchanged. The counter never reaches `USER_MAX_PASSWORD_ATTEMPTS` (10) and the lockout gate never fires. A successful guess returns a `{clientId, clientToken}` pair. The token can be exchanged via `POST /api/app/sync/auth/cookie` for a full JWT. While the code is valid, the attacker can also call `POST /api/auth/2fa/disable` to permanently remove MFA. Version 2.4.0 patches the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00219 12th percentileScored 2026-11-07

Fix Fixed server (Sync-in): 2.4.0@sync-in/server (npm): 2.4.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Sync-in	server	before 2.4.0	2.4.0	Patch available	CNA
—	@sync-in/server (npm)	before 2.4.0	2.4.0	Patch available	GHSA-274f-6w77-8qm9

server VendorSync-in Affected before 2.4.0 Fixed in 2.4.0 Patch available CNA
@sync-in/server (npm) Vendor— Affected before 2.4.0 Fixed in 2.4.0 Patch available GHSA-274f-6w77-8qm9

Remediation

Fix · CNA server (Sync-in) Fixed in 2.4.0
Fix · GHSA-274f-6w77-8qm9 @sync-in/server (npm) Fixed in 2.4.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-58271
2026-10-03 Alias added: GHSA-274f-6w77-8qm9

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-58271

Other 5

TI-2026-41960 Sync-in Server has a complete 2FA Bypass via `POST /api/auth/token` CVSS 3.1HIGH 8.1
TI-2026-29787 Username Enumeration via Timing Attack CVSS 4.0MEDIUM 6.9
TI-2026-35188 Sync-in Server: SSRF protection bypass via IPv4-mapped IPv6 addresses in regExpPrivateIP CVSS 3.1HIGH 7.7
TI-2026-41963 Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST… CVSS 3.1MEDIUM 5.3
TI-2026-41961 Sync-in Server has a ReDoS via Unsanitized Regex in Sync Diff `pathFilters` CVSS 3.1MEDIUM 6.5
TI-2025-41214 A Stored Cross-Site Scripting (XSS) vulnerability in Sync-in Server before 1.9.3 allows… CVSS 3.1MEDIUM 6.1

See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences