GHSA-29HQ-23M2-2J47 Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login (incomplete fix of the prior timing-attack advisory)

🗓️ 22 Sep 2026 14:49:23Reported by GoogleType

osv🔗 osv.dev👁 3 Views

Summary validateUser() in backend/src/authentication/providers/mysql/auth-provider-mysql.service.ts returns immediately when the supplied login/email does not match any account, without ever calling comparePassword(): async validateUser(loginOrEma...

Reporter	Title	Published	Views	Family All 7
Circl	CVE-2026-58272	22 Sep 202616:31	–	circl
CVE	CVE-2026-58272	21 Sep 202620:31	–	cve
Cvelist	CVE-2026-58272 Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login (incomplete fix of the prior timing-attack advisory)	21 Sep 202620:31	–	cvelist
EUVD	EUVD-2026-84199	22 Sep 202614:49	–	euvd
Github Security Blog	Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login (incomplete fix of the prior timing-attack advisory)	22 Sep 202614:49	–	github
NVD	CVE-2026-58272	21 Sep 202621:17	–	nvd
Rapid7 Vulnerability Database (full)	CVE-2026-58272: Observable Timing Discrepancy	21 Sep 202600:00	–	rapid7

Source	Link
github	www.github.com/Sync-in/server/security/advisories/GHSA-29hq-23m2-2j47
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-58272
github	www.github.com/Sync-in/server/commit/b80efe04574039a7a302c0e1007f03a7dbe6a633
github	www.github.com/Sync-in/server
github	www.github.com/Sync-in/server/releases/tag/v2.4.1

22 Sep 2026 15:00Current

CVSS 3.15.3