CVE-2026-58271

Summary

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, POST /api/app/sync/register accepts credentials and a TOTP code to register a desktop sync client. On a failed TOTP, SyncClientsManager.register() calls updateAccesses(user, ip, false), which hits a freeze branch that writes passwordAttempts back unchanged. The counter never reaches USER_MAX_PASSWORD_ATTEMPTS (10) and the lockout gate never fires. A successful guess returns a {clientId, clientToken} pair. The token can be exchanged via POST /api/app/sync/auth/cookie for a full JWT. While the code is valid, the attacker can also call POST /api/auth/2fa/disable to permanently remove MFA. Version 2.4.0 patches the issue.

Affected Software

Weaknesses

• CWE-307: CWE-307: Improper Restriction of Excessive Authentication Attempts

References

• https://github.com/Sync-in/server/security/advisories/GHSA-274f-6w77-8qm9

• ←Previous
• Next→