Sync-in Server up to 2.3.x Lockout /api/app/sync/register SyncClientsManager.register excessive authentication

Summaryinfo

A vulnerability, which was classified as problematic, was found in Sync-in Server up to 2.3.x. Affected is the function SyncClientsManager.register of the file /api/app/sync/register of the component Lockout. Such manipulation leads to excessive authentication. This vulnerability is uniquely identified as CVE-2026-58271. The attack can be launched remotely. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Sync-in Server up to 2.3.x. Affected by this issue is the function SyncClientsManager.register of the file /api/app/sync/register of the component Lockout. The manipulation with an unknown input leads to a excessive authentication vulnerability. Using CWE to declare the problem leads to CWE-307. The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks. Impacted is confidentiality. CVE summarizes:

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, `POST /api/app/sync/register` accepts credentials and a TOTP code to register a desktop sync client. On a failed TOTP, `SyncClientsManager.register()` calls `updateAccesses(user, ip, false)`, which hits a freeze branch that writes `passwordAttempts` back unchanged. The counter never reaches `USER_MAX_PASSWORD_ATTEMPTS` (10) and the lockout gate never fires. A successful guess returns a `{clientId, clientToken}` pair. The token can be exchanged via `POST /api/app/sync/auth/cookie` for a full JWT. While the code is valid, the attacker can also call `POST /api/auth/2fa/disable` to permanently remove MFA. Version 2.4.0 patches the issue.

The advisory is available at github.com. This vulnerability is handled as CVE-2026-58271 since 06/29/2026. The exploitation is known to be difficult. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1110.001 by the MITRE ATT&CK project.

Upgrading to version 2.4.0 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Sync-in

Name

• Server

Version

• 2.0
• 2.1
• 2.2
• 2.3

Website

• Product: https://github.com/Sync-in/server/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion