CVE-2026-58271: @sync-in/server vulnerable to TOTP Brute-Force via `POST /api/app/sync/register`

CVE-2026-58271 · Severity: medium · CVSS 6.8 · Published 2026-09-21

Sync-in Server is a file storage and collaboration platform. A flaw in the desktop sync client registration endpoint allows an attacker with valid user credentials to bypass account lockout protections and brute-force the time-based two-factor authentication (TOTP) code. Once the code is guessed, the attacker can register a malicious sync client and disable MFA entirely, gaining full account access.

Technologies: @sync-in/server (npm). Vendors: npm.

Quick answers

Is CVE-2026-58271 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-58271 being exploited in the wild.
How severe is CVE-2026-58271?
Medium severity, with a CVSS score of 6.8, published 21 September 2026.
Which products and versions are affected?
@sync-in/server (npm) <= 2.3.0, SEMVER:introduced=0,fixed=2.4.0.
Is there a fix for CVE-2026-58271?
Yes. @sync-in/server (npm): upgrade to 2.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-58271 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-58271?
Check whether you run @sync-in/server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @sync-in/server (npm): upgrade to 2.4.0 or later
    npm install @sync-in/server@2.4.0

Technical details

The vulnerability is a broken authentication logic flaw in the updateAccesses() method of users-manager.service.ts. When register() in sync-clients-manager.service.ts processes a failed TOTP attempt, it calls updateAccesses(user, ip, false) with the isAuthTwoFa parameter defaulting to false. The condition `if (!isAuthTwoFa && configuration.auth.mfa.totp.enabled && user.twoFaEnabled)` evaluates to true, causing the password attempt counter to be preserved unchanged instead of incremented. This "freeze" was intended for the two-factor verification flow but was incorrectly triggered for outright TOTP rejections at registration. As a result, the lockout gate that fires after 10 failed attempts never activates. An attacker with valid credentials can brute-force ~333k possible TOTP codes (at expected mean, with 3 valid codes per 30-second window) without account lockout. Upon guessing a valid code, the attacker registers a sync client and receives a client token, which can be exchanged for an authenticated session. The attacker can then call POST /api/auth/2fa/disable to remove MFA while the guessed TOTP code is still valid. The fix was patched in v2.4.0 by adding `&& success` to the freeze condition, ensuring the counter increments on both failed passwords and failed TOTP codes.

Affected products

  • Sync-in Server <=2.3.0

Identifiers

  • CVE-2026-58271
  • GHSA-274f-6w77-8qm9

Timeline

  • 2026-09-22: disclosed: GHSA-274f-6w77-8qm9 published
  • 2026-06-22: patched: Fixed in v2.4.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.