Executive brief
Sync-in Server is a file storage and collaboration platform. A flaw in the desktop sync client registration endpoint allows an attacker with valid user credentials to bypass account lockout protections and brute-force the time-based two-factor authentication (TOTP) code. Once the code is guessed, the attacker can register a malicious sync client and disable MFA entirely, gaining full account access.
Technical details
The vulnerability is a broken authentication logic flaw in the updateAccesses() method of users-manager.service.ts. When register() in sync-clients-manager.service.ts processes a failed TOTP attempt, it calls updateAccesses(user, ip, false) with the isAuthTwoFa parameter defaulting to false. The condition `if (!isAuthTwoFa && configuration.auth.mfa.totp.enabled && user.twoFaEnabled)` evaluates to true, causing the password attempt counter to be preserved unchanged instead of incremented. This "freeze" was intended for the two-factor verification flow but was incorrectly triggered for outright TOTP rejections at registration. As a result, the lockout gate that fires after 10 failed attempts never activates. An attacker with valid credentials can brute-force ~333k possible TOTP codes (at expected mean, with 3 valid codes per 30-second window) without account lockout. Upon guessing a valid code, the attacker registers a sync client and receives a client token, which can be exchanged for an authenticated session. The attacker can then call POST /api/auth/2fa/disable to remove MFA while the guessed TOTP code is still valid. The fix was patched in v2.4.0 by adding `&& success` to the freeze condition, ensuring the counter increments on both failed passwords and failed TOTP codes.
Affected products
- Sync-in Server <=2.3.0
Timeline
- 2026-09-22: disclosed: GHSA-274f-6w77-8qm9 published
- 2026-06-22: patched: Fixed in v2.4.0