High severity8.1NVD Advisory· Published Sep 21, 2026· Updated Sep 24, 2026
CVE-2026-58269
CVE-2026-58269
Description
Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, POST /api/auth/token authenticates with username and password only, then calls getTokens(), which returns full access and refresh JWTs without checking whether the account has TOTP 2FA enabled. An attacker with stolen or phished credentials can bypass 2FA in a single request. The parallel login endpoint (POST /api/auth/login) correctly enforces 2FA by calling setCookies(user, res, true), which gates on user.twoFaEnabled. Version 2.4.0 patches the issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
@sync-in/servernpm | < 2.4.0 | 2.4.0 |
Affected products
1Patches
Vulnerability mechanics
References
6- github.com/advisories/GHSA-92cr-jxw4-5wjgghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-58269ghsaADVISORY
- github.com/Sync-in/server/commit/3ec74e2ea1f538fe1a3ac9487bdf24a19e548361ghsaWEB
- github.com/Sync-in/server/pull/228ghsaWEB
- github.com/Sync-in/server/releases/tag/v2.4.0ghsaWEB
- github.com/Sync-in/server/security/advisories/GHSA-92cr-jxw4-5wjgnvdWEB
News mentions
0No linked articles in our index yet.