CVE-2026-58271
MediumCVSS 6.8Summary
In Sync-in Server prior to version 2.4.0, the failed-TOTP lockout mechanism does not work because the passwordAttempts counter is never incremented. An attacker can brute-force TOTP codes without limit, and upon success obtain a client token exchangeable for a full JWT and permanently disable MFA.
Risk Assessment
Loss of effective MFA protection allows an attacker to take over accounts and permanently weaken authentication security in the organization.
Recommendation
Upgrade Sync-in Server to version 2.4.0 or later, and until then monitor for unusual sync client registration attempts and MFA disablement.
Other vulnerabilities in Sync-in Server
See all- CVE-2026-58272Medium
Sync-in Server before version 2.4.1 has an observable timing discrepancy in the login endpoint because authentication attempts for nonexistent accounts return without performing the bcrypt comparison used for existing accounts. An unauthenticated attacker can measure response times to enumerate valid usernames or email addresses, facilitating credential-stuffing, password-spraying, and phishing attacks. Version 2.4.1 contains a patch.
- CVE-2026-58270Medium
Sync-in Server before version 2.4.0 has a vulnerability in the sync diff endpoint where it compiles a user-supplied string into a RegExp with no complexity validation. A catastrophic-backtracking pattern (e.g. ^(a+)+b) blocks the Node.js event loop, making the entire server unresponsive to all users until the container is restarted. Version 2.4.0 patches the issue.
- CVE-2026-58269High
Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, POST /api/auth/token authenticates with username and password only, then calls getTokens(), which returns full access and refresh JWTs without checking whether the account has TOTP 2FA enabled. An attacker with stolen or phished credentials can bypass 2FA in a single request. The parallel login endpoint (POST /api/auth/login) correctly enforces 2FA by calling setCookies(user, res, true), which gates on user.twoFaEnabled. Version 2.4.0 patches the issue.
- CVE-2026-47684High
Sync-in Server is a secure, open-source platform for file storage, sharing, collaboration, and syncing. In versions prior to 2.3.0, the regex used in the URL download feature for blocking private IP addresses does not match IPv4-mapped IPv6 addresses, allowing SSRF protection to be bypassed on dual-stack systems.
Original NVD description (English source)
Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, `POST /api/app/sync/register` accepts credentials and a TOTP code to register a desktop sync client. On a failed TOTP, `SyncClientsManager.register()` calls `updateAccesses(user, ip, false)`, which hits a freeze branch that writes `passwordAttempts` back unchanged. The counter never reaches `USER_MAX_PASSWORD_ATTEMPTS` (10) and the lockout gate never fires. A successful guess returns a `{clientId, clientToken}` pair. The token can be exchanged via `POST /api/app/sync/auth/cookie` for a full JWT. While the code is valid, the attacker can also call `POST /api/auth/2fa/disable` to permanently remove MFA. Version 2.4.0 patches the issue.