CVE-2026-58272

Received Received - Intake

Observable Timing Discrepancy in Sync-in Server Login

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Versions prior to 2.4.1 contain an observable timing discrepancy in the login endpoint because authentication attempts for nonexistent accounts return without performing the bcrypt comparison used for existing accounts. An unauthenticated attacker can measure response times to enumerate valid usernames or email addresses, facilitating credential-stuffing, password-spraying, and phishing attacks. Version 2.4.1 contains a patch.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-21

Last Modified

2026-09-21

Generated

2026-09-22

AI Q&A

2026-09-22

EPSS Evaluated

N/A

NVD

CVE-2026-58272

Affected Vendors & Products

Vendor	Product	Version / Range
sync-in	server	to 2.4.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-208	Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.

Attack-Flow Graph

Executive Summary

This vulnerability is a timing discrepancy in the login endpoint of Sync-in Server versions prior to 2.4.1. When an attacker tries to log in with a nonexistent account, the server responds faster than for existing accounts because it skips the bcrypt password comparison. This allows attackers to measure response times and determine valid usernames or email addresses.

Detection Guidance

This vulnerability can be detected by measuring response times from the login endpoint. Existing accounts will have slightly longer response times due to bcrypt comparison, while nonexistent accounts return faster. Use tools like curl or custom scripts to send login requests and compare response times for different usernames or emails.

Impact Analysis

An attacker could use this vulnerability to identify valid accounts on the system. This information could then be used for credential-stuffing, password-spraying, or phishing attacks, potentially leading to unauthorized access if weak or reused passwords are used.

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR and HIPAA by enabling attackers to enumerate valid usernames or email addresses, which may facilitate further attacks like credential stuffing or phishing. Such attacks could lead to unauthorized access to personal or health data, violating data protection requirements under these regulations.

Mitigation Strategies

Upgrade to Sync-in Server version 2.4.1 or later, which contains the patch for this issue. If immediate upgrade is not possible, consider implementing rate limiting on the login endpoint or disabling the login feature temporarily to prevent username enumeration.

Hi! I’m here to help you understand CVE-2026-58272. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70