CVE-2026-58269 Details
Description
Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, `POST /api/auth/token` authenticates with username and password only, then calls `getTokens()`, which returns full access and refresh JWTs without checking whether the account has TOTP 2FA enabled. An attacker with stolen or phished credentials can bypass 2FA in a single request. The parallel login endpoint (`POST /api/auth/login`) correctly enforces 2FA by calling `setCookies(user, res, true)`, which gates on `user.twoFaEnabled`. Version 2.4.0 patches the issue.
A vulnerability in Sync-in Server prior to version 2.4.0 allows for bypassing TOTP two-factor authentication (2FA) on accounts with 2FA enabled. The issue arises in the `POST /api/auth/token` endpoint, which authenticates users with their username and password and then issues full access and refresh JSON Web Tokens (JWTs) without verifying if the account has TOTP 2FA enabled. This flaw enables an attacker with stolen or phished credentials to bypass 2FA in a single request. In contrast, the `POST /api/auth/login` endpoint correctly enforces 2FA by requiring a TOTP code before granting access.
Update to Sync-in Server version 2.4.0 or later, and ensure that the token endpoint is gated behind the same 2FA policy as the login route.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 21, 2026CISA-ADP
Assessed Sep 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Sync-in/server/security/advisories/GHSA-92cr-jxw4-5wjg | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/Sync-in/server/security/advisories/GHSA-92cr-jxw4-5wjg | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-288 | Authentication Bypass Using an Alternate Path or Channel | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Sync-in Server | <= 2.3.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 24, 2026 | CVE Modified | CISA-ADP |
| Sep 21, 2026 | New CVE Received | [email protected] |