CVE-2026-58271
Received Received - Intake

Sync-in Server MFA Bypass via TOTP Guess

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description
Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, `POST /api/app/sync/register` accepts credentials and a TOTP code to register a desktop sync client. On a failed TOTP, `SyncClientsManager.register()` calls `updateAccesses(user, ip, false)`, which hits a freeze branch that writes `passwordAttempts` back unchanged. The counter never reaches `USER_MAX_PASSWORD_ATTEMPTS` (10) and the lockout gate never fires. A successful guess returns a `{clientId, clientToken}` pair. The token can be exchanged via `POST /api/app/sync/auth/cookie` for a full JWT. While the code is valid, the attacker can also call `POST /api/auth/2fa/disable` to permanently remove MFA. Version 2.4.0 patches the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-22
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-58271
EUVD
EUVD-2026-84112

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
sync-in server 2.4.0
sync-in server to 2.4.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-307 The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-58271 is a brute-force vulnerability in Sync-in Server versions 2.3.0 and below. It allows attackers to bypass TOTP (Time-based One-Time Password) verification by exploiting a flaw in the password attempt counter logic. When TOTP verification fails, the system incorrectly preserves the attempt counter instead of incrementing it, preventing account lockout. This enables attackers to make thousands of failed attempts without triggering security measures.

Detection Guidance

Monitor excessive failed TOTP attempts on the POST /api/app/sync/register endpoint. Check logs for repeated registration requests with invalid TOTP codes. Look for unusual client registration activity or unexpected JWT token generation from the /api/app/sync/auth/cookie endpoint.

Impact Analysis

An attacker could exploit this to gain unauthorized access to user accounts by guessing valid TOTP codes. Once access is obtained, they can register a sync client, exchange the client token for a full JWT session, and even permanently disable MFA for the account. This compromises both confidentiality and integrity of user data.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection standards like GDPR and HIPAA, which mandate strong authentication controls and protection against unauthorized access. The lack of proper account lockout mechanisms and susceptibility to brute-force attacks could result in unauthorized data exposure or modification, leading to regulatory penalties and loss of trust.

Mitigation Strategies

Upgrade to Sync-in Server version 2.4.0 or later to patch the vulnerability. Implement rate limiting on the POST /api/app/sync/register endpoint to prevent brute-force attacks. Review and monitor accounts for unauthorized client registrations or MFA disable actions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-58271. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart