Authentication Bypass in Sync-in Server Affected by Insecure Token Handling

CVE-2026-58269

What is CVE-2026-58269?

The Sync-in Server, an open-source platform for file storage and collaboration, has a vulnerability that allows an attacker to bypass two-factor authentication (2FA) by exploiting its token handling mechanism. Prior to version 2.4.0, the API endpoint POST /api/auth/token only required a username and password for authentication, enabling attackers with stolen credentials to obtain full access tokens without verifying whether 2FA was enabled for the account. This flaw not only compromises account security but also exposes user data to potential malicious activities. Version 2.4.0 resolves this issue by enforcing proper 2FA checks during token generation, thus enhancing the overall security posture of the application.

References