Sync-in Server: Four Vulnerabilities Allow 2FA Bypass, Brute-Force, Username Enumeration, and Denial of Service

What happened

Four vulnerabilities were disclosed in Sync-in Server (@sync-in/server, npm package): 1. CVE-2026-58269 (GHSA-92cr-jxw4-5wjg) — A complete 2FA bypass. The `POST /api/auth/token` endpoint authenticates with username and password only, then issues full access and refresh JWTs via `getTokens()` without checking whether the account has TOTP 2FA enabled. The parallel login endpoint (`POST /api/auth/login`) correctly enforces 2FA by checking `user.twoFaEnabled`, but the token endpoint does not. 2. CVE-2026-58271 (GHSA-274f-6w77-8qm9) — A TOTP brute-force flaw in the desktop sync client registration endpoint (`POST /api/app/sync/register`). On a failed TOTP attempt, the internal `updateAccesses()` function hits a freeze branch that writes the `passwordAttempts` counter back unchanged, so it never reaches the configured maximum (`USER_MAX_PASSWORD_ATTEMPTS`, 10) and the lockout never triggers. A successful guess returns a client token pair that can be exchanged for a full JWT via `POST /api/app/sync/auth/cookie`. With a valid code, an attacker could also call `POST /api/auth/2fa/disable` to permanently remove MFA from the account. 3. CVE-2026-58270 (GHSA-jx63-h26r-8cph) — A regular expression denial-of-service (ReDoS). The sync diff endpoint compiles a user-supplied string directly into a `RegExp` without complexity validation. A catastrophic-backtracking pattern (e.g. `^(a+)+b`) blocks the Node.js event loop, making the entire server unresponsive to all users until the container is restarted. 4. CVE-2026-58272 (GHSA-29hq-23m2-2j47) — An observable timing discrepancy in the login endpoint. Authentication attempts for nonexistent accounts return without performing the bcrypt comparison used for existing accounts, allowing an unauthenticated attacker to measure response times and enumerate valid usernames or email addresses. This advisory is described as an incomplete fix of a prior timing-attack issue.

Technical cause

Each issue stems from a different root cause: CVE-2026-58269 is an alternate-path authentication bypass (CWE-288) where the token-issuing code path omits the 2FA check present elsewhere in the code. CVE-2026-58271 is an improper restriction of excessive authentication attempts (CWE-307) caused by a 'freeze branch' in the attempt-counting logic that writes back the attempt counter unchanged instead of incrementing it. CVE-2026-58270 is an inefficient regular expression complexity issue (CWE-1333) from compiling untrusted user input directly into a RegExp without validation. CVE-2026-58272 is an observable timing discrepancy (CWE-208) where the code path for nonexistent accounts skips the bcrypt comparison performed for existing accounts, creating a measurable timing difference.

Why it matters

These issues target the authentication layer and overall availability of Sync-in Server. CVE-2026-58269 allows an attacker who has already obtained valid credentials (stolen or phished) to fully bypass 2FA in a single request, gaining full account access. CVE-2026-58271 compounds this: it enables brute-forcing of the TOTP code with no effective lockout, and a successful guess allows permanent removal of 2FA from the account via the disable endpoint, effectively eliminating MFA protection going forward. CVE-2026-58270 is a service-wide denial-of-service: a single malicious request can make the server unresponsive to all users until manually restarted. CVE-2026-58272 lowers the bar for subsequent credential-stuffing or password-spraying attacks by letting an unauthenticated attacker confirm which usernames or email addresses are valid.

Affected versions

@sync-in/server: CVE-2026-58269, CVE-2026-58271, and CVE-2026-58270 affect versions up to and including 2.3.0, fixed in 2.4.0. CVE-2026-58272 affects versions up to and including 2.4.0, fixed in 2.4.1.

Fixes and mitigation

Version 2.4.0 of @sync-in/server patches the 2FA bypass (CVE-2026-58269), the TOTP brute-force/lockout issue (CVE-2026-58271), and the ReDoS issue (CVE-2026-58270). Version 2.4.1 additionally patches the timing-based username enumeration issue (CVE-2026-58272), which was not fully addressed by a prior fix. Operators should update directly to 2.4.1 to receive all four fixes.

Recommended action

Update @sync-in/server to version 2.4.1 as soon as possible to apply all available patches. If an immediate update is not possible, treat the deployment as having unreliable 2FA enforcement and monitor for unusual account access, repeated TOTP submission attempts, and signs of service disruption. After updating, consider reviewing accounts for any 2FA settings that may have been altered during the affected period.