Executive brief
Sync-in Server is a collaboration platform that uses two-factor authentication (2FA) to protect user accounts. The token authentication endpoint fails to enforce 2FA requirements, allowing an attacker with valid username and password to obtain full API access tokens without providing a second factor. This completely bypasses 2FA security for API-based authentication flows.
Technical details
The vulnerability is an authentication bypass in the `POST /api/auth/token` endpoint (auth.controller.ts:50–55). The endpoint validates credentials using `AuthLocalGuard` (password-only) and immediately calls `getTokens()` to issue unrestricted Bearer access and refresh JWTs. The `getTokens()` function never checks the `user.twoFaEnabled` flag, unlike the parallel `/api/auth/login` endpoint which correctly gates 2FA-protected flows. An attacker who possesses valid credentials for any 2FA-enabled account can send a single POST request to bypass 2FA entirely, receiving full bearer tokens without providing a TOTP code. No user interaction or knowledge of the 2FA secret is required. The fix requires adding a 2FA verification gate in the token endpoint identical to the login route.
Affected products
- Sync-in Server v2.3.0
Timeline
- 2026-09-22: disclosed: GHSA-92cr-jxw4-5wjg published
- 2026-01-01: other: CVE-2026-58269 assigned