# CVE-2026-58271: @sync-in/server vulnerable to TOTP Brute-Force via `POST /api/app/sync/register`

Source: https://junglewise.ai/threats/cve-2026-58271-sync-in-server-totp-brute-force-in-sync-registration  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-21. Updated: 2026-09-24  
License: CC BY 4.0 with a link back

CVE-2026-58271 · Severity: medium · CVSS 6.8 · Published 2026-09-21

Sync-in Server is a file storage and collaboration platform. A flaw in the desktop sync client registration endpoint allows an attacker with valid user credentials to bypass account lockout protections and brute-force the time-based two-factor authentication (TOTP) code. Once the code is guessed, the attacker can register a malicious sync client and disable MFA entirely, gaining full account access.

Technologies: [@sync-in/server (npm)](https://junglewise.ai/threats/technologies/sync-in-server). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-58271 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-58271 being exploited in the wild.

**How severe is CVE-2026-58271?** Medium severity, with a CVSS score of 6.8, published 21 September 2026.

**Which products and versions are affected?** @sync-in/server (npm) <= 2.3.0, SEMVER:introduced=0,fixed=2.4.0.

**Is there a fix for CVE-2026-58271?** Yes. @sync-in/server (npm): upgrade to 2.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-58271 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-58271?** Check whether you run @sync-in/server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @sync-in/server (npm): upgrade to 2.4.0 or later

  ```sh
  npm install @sync-in/server@2.4.0
  ```


## Technical details

The vulnerability is a broken authentication logic flaw in the updateAccesses() method of users-manager.service.ts. When register() in sync-clients-manager.service.ts processes a failed TOTP attempt, it calls updateAccesses(user, ip, false) with the isAuthTwoFa parameter defaulting to false. The condition `if (!isAuthTwoFa && configuration.auth.mfa.totp.enabled && user.twoFaEnabled)` evaluates to true, causing the password attempt counter to be preserved unchanged instead of incremented. This "freeze" was intended for the two-factor verification flow but was incorrectly triggered for outright TOTP rejections at registration. As a result, the lockout gate that fires after 10 failed attempts never activates. An attacker with valid credentials can brute-force ~333k possible TOTP codes (at expected mean, with 3 valid codes per 30-second window) without account lockout. Upon guessing a valid code, the attacker registers a sync client and receives a client token, which can be exchanged for an authenticated session. The attacker can then call POST /api/auth/2fa/disable to remove MFA while the guessed TOTP code is still valid. The fix was patched in v2.4.0 by adding `&& success` to the freeze condition, ensuring the counter increments on both failed passwords and failed TOTP codes.

## Affected products

- Sync-in Server <=2.3.0

## Identifiers

- CVE-2026-58271
- GHSA-274f-6w77-8qm9

## Timeline

- 2026-09-22: disclosed: GHSA-274f-6w77-8qm9 published
- 2026-06-22: patched: Fixed in v2.4.0

## References

- [https://github.com/Sync-in/server/security/advisories/GHSA-274f-6w77-8qm9](https://github.com/Sync-in/server/security/advisories/GHSA-274f-6w77-8qm9)
- [https://github.com/Sync-in/server/pull/228](https://github.com/Sync-in/server/pull/228)
- [https://github.com/Sync-in/server/commit/b13a4aad5c2b38fe8231a0d007cd08a086ec5bdb](https://github.com/Sync-in/server/commit/b13a4aad5c2b38fe8231a0d007cd08a086ec5bdb)
- [https://github.com/Sync-in/server](https://github.com/Sync-in/server)
- [https://github.com/Sync-in/server/releases/tag/v2.4.0](https://github.com/Sync-in/server/releases/tag/v2.4.0)

## Related threats

- [Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login (incomplete fix of the prior timing-attack advisory)](https://junglewise.ai/threats/cve-2026-58272-sync-in-server-username-enumeration-via-timing-side-channel-in)
- [Sync-in Server ReDoS via unsanitized regex in pathFilters](https://junglewise.ai/threats/cve-2026-58270-sync-in-server-redos-via-unsanitized-regex-in-pathfilters)
- [Sync-in Server two-factor authentication bypass in token endpoint](https://junglewise.ai/threats/cve-2026-58269-sync-in-server-two-factor-authentication-bypass-in-token-endpoint)
- [Sync-in Server SSRF bypass via IPv4-mapped IPv6 addresses](https://junglewise.ai/threats/cve-2026-47684-sync-in-server-ssrf-bypass-via-ipv4-mapped-ipv6-addresses)
- [Sync-in Server username enumeration via timing attack in login endpoint](https://junglewise.ai/threats/cve-2026-41161-sync-in-server-has-username-enumeration-via-timing-attack)