← Back to search

CVE-2026-58269

8.1 HIGHpublic exploit available

Published 2026-09-21 · Updated 2026-09-21

AI risk analysis

Summary
The flaw allows an attacker with stolen or phished credentials to bypass two-factor authentication (2FA) in a single request by exploiting the `POST /api/auth/token` endpoint before version 2.4.0, enabling unauthorized access.
Exploitability
Exploitation is relatively easy given that attackers need only steal or phishing obtain valid credentials and send them to the vulnerable endpoint.
Blast radius
If exploited, this could lead to full account compromise for users with 2FA enabled, as the attacker would gain full access without needing to bypass 2FA.
Prioritized remediation
Upgrade to Sync-in Server version 2.4.0 or later to apply the necessary security patch.
auth-bypasswebapisecurity-patch

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, `POST /api/auth/token` authenticates with username and password only, then calls `getTokens()`, which returns full access and refresh JWTs without checking whether the account has TOTP 2FA enabled. An attacker with stolen or phished credentials can bypass 2FA in a single request. The parallel login endpoint (`POST /api/auth/login`) correctly enforces 2FA by calling `setCookies(user, res, true)`, which gates on `user.twoFaEnabled`. Version 2.4.0 patches the issue.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weaknesses

CWE-288

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.