CVE-2026-58269: Sync-in Server two-factor authentication bypass in token endpoint

CVE-2026-58269 · Severity: high · CVSS 8.1 · Published 2026-09-21

Sync-in Server is a collaboration platform that uses two-factor authentication (2FA) to protect user accounts. The token authentication endpoint fails to enforce 2FA requirements, allowing an attacker with valid username and password to obtain full API access tokens without providing a second factor. This completely bypasses 2FA security for API-based authentication flows.

Technologies: @sync-in/server (npm). Vendors: npm.

Quick answers

Is CVE-2026-58269 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-58269 being exploited in the wild.
How severe is CVE-2026-58269?
High severity, with a CVSS score of 8.1, published 21 September 2026.
Which products and versions are affected?
@sync-in/server (npm) <= 2.3.0, SEMVER:introduced=0,fixed=2.4.0.
Is there a fix for CVE-2026-58269?
Yes. @sync-in/server (npm): upgrade to 2.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-58269 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-58269?
Check whether you run @sync-in/server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @sync-in/server (npm): upgrade to 2.4.0 or later
    npm install @sync-in/server@2.4.0

Technical details

The vulnerability is an authentication bypass in the `POST /api/auth/token` endpoint (auth.controller.ts:50–55). The endpoint validates credentials using `AuthLocalGuard` (password-only) and immediately calls `getTokens()` to issue unrestricted Bearer access and refresh JWTs. The `getTokens()` function never checks the `user.twoFaEnabled` flag, unlike the parallel `/api/auth/login` endpoint which correctly gates 2FA-protected flows. An attacker who possesses valid credentials for any 2FA-enabled account can send a single POST request to bypass 2FA entirely, receiving full bearer tokens without providing a TOTP code. No user interaction or knowledge of the 2FA secret is required. The fix requires adding a 2FA verification gate in the token endpoint identical to the login route.

Affected products

  • Sync-in Server v2.3.0

Identifiers

  • CVE-2026-58269
  • GHSA-92cr-jxw4-5wjg

Timeline

  • 2026-09-22: disclosed: GHSA-92cr-jxw4-5wjg published
  • 2026-01-01: other: CVE-2026-58269 assigned

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.