CVE-2026-58271: falha de média gravidade em Sync-in server
@sync-in/server vulnerable to TOTP Brute-Force via `POST /api/app/sync/register`
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.8epss 0.2%
Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, `POST /api/app/sync/register` accepts credentials and a TOTP code to register a desktop sync client. On a failed TOTP, `SyncClientsManager.register()` calls `updateAccesses(user, ip, false)`, which hits a freeze branch that writes `passwordAttempts` back unchanged. The counter never reaches `USER_MAX_PASSWORD_ATTEMPTS` (10) and the lockout gate never fires. A successful guess returns a `{clientId, clientToken}` pair. The token can be exchanged via `POST /api/app/sync/auth/cookie` for a full JWT. While the code is valid, the attacker can also call `POST /api/auth/2fa/disable` to permanently remove MFA. Version 2.4.0 patches the issue.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Produtos afetados
Sync-in · serverCVEs relacionadas — Sync-in server
No mesmo produto, das mais perigosas para as menos.
CVE-2026-58270MEDIUMSync-in Server has a ReDoS via Unsanitized Regex in Sync Diff `pathFilters`EPSS 0.4%CVE-2026-58272MEDIUMSync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login (incomplete fix of the prior timing-attack advisory)EPSS 0.4%CVE-2026-41161MEDIUMUsername Enumeration via Timing AttackEPSS 0.3%CVE-2026-58269HIGHSync-in Server has a complete 2FA Bypass via `POST /api/auth/token`EPSS 0.3%CVE-2026-47684HIGHSync-in Server: SSRF protection bypass via IPv4-mapped IPv6 addresses in regExpPrivateIPEPSS 0.2%