CVE-2026-58269: Sync-in Server has a complete 2FA Bypass via `POST /api/auth/token`
Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, POST /api/auth/token authenticates with username and password only, then calls getTokens(), which returns full access and refresh JWTs without checking whether the account has TOTP 2FA enabled. An attacker with stolen or phished credentials can bypass 2FA in a single request. The parallel login endpoint (POST /api/auth/login) correctly enforces 2FA by calling setCookies(user, res, true), which gates on user.twoFaEnabled. Version 2.4.0 patches the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Sync-in Serverto a version that resolves this vulnerability.Fixed in 2.4.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs a valid username and password for a Sync-in Server account with TOTP 2FA enabled. Stolen or phished credentials are sufficient; no user interaction is required.
Which authentication path is affected?
The affected path is POST /api/auth/token, which issues full access and refresh JWTs after validating only the username and password. POST /api/auth/login is described as correctly enforcing 2FA.
Are accounts without TOTP 2FA affected?
The bypass specifically affects accounts that have TOTP 2FA enabled, because the token endpoint does not check that setting before issuing tokens. Accounts without TOTP 2FA do not rely on the missing check.
What version fixes the issue?
Sync-in Server version 2.4.0 patches the vulnerability.