CVE-2026-58271
Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing.
Impact
Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, `POST /api/app/sync/register` accepts credentials and a TOTP code to register a desktop sync client. On a failed TOTP, `SyncClientsManager.register()` calls `updateAccesses(user, ip, false)`, which hits a freeze branch that writes `passwordAttempts` back unchanged. The counter never reaches `USER_MAX_PASSWORD_ATTEMPTS` (10) and the lockout gate never fires. A successful guess returns a `{clientId, clientToken}` pair. The token can be exchanged via `POST /api/app/sync/auth/cookie` for a full JWT. While the code is valid, the attacker can also call `POST /api/auth/2fa/disable` to permanently remove MFA. Version 2.4.0 patches the issue.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @sync-in/server | <= 2.3.0 | 2.4.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-274f-6w77-8qm9
- https://github.com/Sync-in/server/security/advisories/GHSA-274f-6w77-8qm9
- https://nvd.nist.gov/vuln/detail/CVE-2026-58271
- https://github.com/Sync-in/server/pull/228
- https://github.com/Sync-in/server/commit/b13a4aad5c2b38fe8231a0d007cd08a086ec5bdb
- https://github.com/Sync-in/server/releases/tag/v2.4.0