Authentication Bypass in Sync-in Server for File Storage and Collaboration
CVE-2026-58271

6.8MEDIUM

Key Information:

Vendor

Sync-in

Status
Server
Vendor
CVE Published:
21 September 2026

What is CVE-2026-58271?

The Sync-in Server, an open-source platform designed for file storage and sharing, has a vulnerability related to its registration process for desktop sync clients. In versions prior to 2.4.0, an attacker can exploit the POST /api/app/sync/register endpoint to bypass two-factor authentication (2FA) by submitting incorrect TOTP codes. This leads to a scenario where the password attempt counter remains unchanged, preventing the account lockout mechanism from triggering. As a result, successful credentials can yield a {clientId, clientToken} pair which can be exchanged for a full JWT via the POST /api/app/sync/auth/cookie endpoint. Furthermore, the attacker can call POST /api/auth/2fa/disable to disable multi-factor authentication permanently, undermining account security. This vulnerability has been patched in version 2.4.0.

Affected Version(s)

server < 2.4.0

References

https://github.com/Sync-in/server/security/advisories/GHS...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.