Executive brief
Sync-in Server's login endpoint leaks information about valid usernames through response time differences. An attacker can measure how long the server takes to respond and determine whether a username exists in the system, without needing credentials. This weakness enables attackers to build a list of valid users, making targeted brute-force attacks and social engineering campaigns more effective.
Technical details
The /api/auth/login endpoint in the users-queries.service.ts file contains a timing-oracle vulnerability (CWE-208) in the compareUserPassword function. When a username does not exist, the function returns early without querying the password hash, causing a significant response-time discrepancy compared to valid usernames (95-100ms vs 350-400ms average). An unauthenticated attacker can enumerate valid usernames by sending login requests and measuring response times; this attack vector is network-based with no authentication or user interaction required. The fix, released in version 2.2.0, ensures consistent response timing regardless of username validity, preventing attackers from distinguishing between valid and invalid accounts through timing analysis.
Affected products
- Sync-in @sync-in/server <= 2.1.0
- Sync-in syncin/server (Docker) <= 2.1.0
Timeline
- 2026-04-15: disclosed
- 2026-04-14: patched: Fixed in v2.2.0