CVE-2026-58272: Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login (incomplete fix of the prior timing-attack advisory)
Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Versions prior to 2.4.1 contain an observable timing discrepancy in the login endpoint because authentication attempts for nonexistent accounts return without performing the bcrypt comparison used for existing accounts. An unauthenticated attacker can measure response times to enumerate valid usernames or email addresses, facilitating credential-stuffing, password-spraying, and phishing attacks. Version 2.4.1 contains a patch.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Sync-in Serverto a version that resolves this vulnerability.Fixed in 2.4.1
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker able to send requests to POST /api/auth/login can attempt to measure response timing differences. No prior account or user interaction is required.
What information can an attacker obtain through the timing difference?
The timing behavior can allow an attacker to distinguish nonexistent accounts from valid usernames or email addresses. It does not by itself disclose passwords, but can support credential-stuffing, password-spraying, and phishing activity.
Which versions are affected and how is it fixed?
Sync-in Server versions before 2.4.1 are affected. Upgrade to version 2.4.1, which contains the patch.