CVE-2026-58269
Received Received - Intake

Authentication Bypass via Missing TOTP Check in Sync-in Server

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description
Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, `POST /api/auth/token` authenticates with username and password only, then calls `getTokens()`, which returns full access and refresh JWTs without checking whether the account has TOTP 2FA enabled. An attacker with stolen or phished credentials can bypass 2FA in a single request. The parallel login endpoint (`POST /api/auth/login`) correctly enforces 2FA by calling `setCookies(user, res, true)`, which gates on `user.twoFaEnabled`. Version 2.4.0 patches the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-22
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-58269
EUVD
EUVD-2026-84115

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
sync-in server to 2.4.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-288 The product requires authentication, but the product has an alternate path or channel that does not require authentication.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-58269 is a high-severity vulnerability in Sync-in Server versions before 2.4.0. It allows attackers to bypass two-factor authentication (2FA) by exploiting the POST /api/auth/token endpoint. The endpoint returns full access tokens without verifying if the account has 2FA enabled, even if the user has it configured.

Detection Guidance

To detect this vulnerability, check if your Sync-in Server version is 2.3.0 or earlier. Verify if the POST /api/auth/token endpoint returns full access tokens without requiring a TOTP code for accounts with 2FA enabled.

Impact Analysis

An attacker with stolen or phished credentials for a 2FA-enabled account can bypass 2FA entirely and gain full API access as the target user. This includes accessing sensitive files, data, and performing actions on behalf of the compromised account.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for GDPR (data protection) and HIPAA (health information privacy). It undermines security controls meant to protect personal or health data.

Mitigation Strategies

Immediately upgrade Sync-in Server to version 2.4.0 or later to patch the vulnerability. Ensure the POST /api/auth/token endpoint enforces 2FA checks like the login endpoint does.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-58269. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart