CVE-2026-58272 Details
Description
Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Versions prior to 2.4.1 contain an observable timing discrepancy in the login endpoint because authentication attempts for nonexistent accounts return without performing the bcrypt comparison used for existing accounts. An unauthenticated attacker can measure response times to enumerate valid usernames or email addresses, facilitating credential-stuffing, password-spraying, and phishing attacks. Version 2.4.1 contains a patch.
A timing attack vulnerability has been identified in Sync-in Server versions prior to 2.4.1. The issue arises in the login authentication process, where requests for non-existent accounts are processed more quickly than those for existing accounts. This discrepancy allows an unauthenticated attacker to infer the validity of usernames or email addresses based on response times. The vulnerability can be exploited to enumerate accounts, potentially leading to credential stuffing, password spraying, or phishing attacks.
Users can upgrade to Sync-in Server version 2.4.1 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 21, 2026CISA-ADP
Assessed Sep 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Sync-in/server/security/advisories/GHSA-29hq-23m2-2j47 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/Sync-in/server/security/advisories/GHSA-29hq-23m2-2j47 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-208 | Observable Timing Discrepancy | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Sync-in Server | <= 2.4.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 23, 2026 | CVE Modified | CISA-ADP |
| Sep 21, 2026 | New CVE Received | [email protected] |