CVE-2026-58271: @sync-in/server vulnerable to TOTP Brute-Force via `POST /api/app/sync/register`
Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, POST /api/app/sync/register accepts credentials and a TOTP code to register a desktop sync client. On a failed TOTP, SyncClientsManager.register() calls updateAccesses(user, ip, false), which hits a freeze branch that writes passwordAttempts back unchanged. The counter never reaches USERMAXPASSWORDATTEMPTS (10) and the lockout gate never fires. A successful guess returns a {clientId, clientToken} pair. The token can be exchanged via POST /api/app/sync/auth/cookie for a full JWT. While the code is valid, the attacker can also call POST /api/auth/2fa/disable to permanently remove MFA. Version 2.4.0 patches the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@sync-in/serverto a version that resolves this vulnerability.Fixed in 2.4.0 - Compensating control
Restrict access to POST /api/app/sync/register and POST /api/auth/2fa/disable to trusted clients/users (e.g., via IP allowlisting/WAF rules) to reduce TOTP brute-force and prevent MFA removal.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs valid user credentials and must be able to reach the sync registration endpoint over the network. They can then repeatedly submit TOTP guesses because failed TOTP attempts do not advance the lockout counter.
What access can an attacker obtain after guessing a valid TOTP code?
A successful registration returns a client ID and client token. The client token can be exchanged for a full JWT, and while the TOTP code remains valid the attacker can call the MFA-disable endpoint to permanently remove MFA.
Are accounts without MFA affected?
The affected flow requires credentials and a TOTP code, so the described brute-force condition applies to accounts using TOTP-based MFA for desktop sync client registration.
What version fixes the issue?
Version 2.4.0 patches the vulnerability.