CVE-2026-58271 Details
Description
Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, `POST /api/app/sync/register` accepts credentials and a TOTP code to register a desktop sync client. On a failed TOTP, `SyncClientsManager.register()` calls `updateAccesses(user, ip, false)`, which hits a freeze branch that writes `passwordAttempts` back unchanged. The counter never reaches `USER_MAX_PASSWORD_ATTEMPTS` (10) and the lockout gate never fires. A successful guess returns a `{clientId, clientToken}` pair. The token can be exchanged via `POST /api/app/sync/auth/cookie` for a full JWT. While the code is valid, the attacker can also call `POST /api/auth/2fa/disable` to permanently remove MFA. Version 2.4.0 patches the issue.
A brute-force vulnerability in the TOTP (Time-based One-Time Password) verification process has been identified in Sync-in Server versions through 2.3.0. The issue arises in the `POST /api/app/sync/register` endpoint, which is used to register desktop sync clients. When a TOTP code is incorrectly entered, the server fails to update the user's password attempt counter, allowing an attacker to repeatedly guess TOTP codes without triggering an account lockout. This vulnerability can be exploited by anyone with valid login credentials for a TOTP-enabled account that has desktop sync permissions.
Update to Sync-in Server version 2.4.0 or later, and add an IP and/or account-based rate limiter to the `POST /api/app/sync/register` endpoint.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 21, 2026CISA-ADP
Assessed Sep 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Sync-in/server/security/advisories/GHSA-274f-6w77-8qm9 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/Sync-in/server/security/advisories/GHSA-274f-6w77-8qm9 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-307 | Improper Restriction of Excessive Authentication Attempts | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Sync-in Server | <= 2.3.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 24, 2026 | CVE Modified | CISA-ADP |
| Sep 21, 2026 | New CVE Received | [email protected] |