CVE-2026-58272 Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login (incomplete fix of the prior timing-attack advisory)

🗓️ 21 Sep 2026 20:31:46Reported by GoogleType

osv_cve🔗 osv.dev👁 23 Views

Unauthenticated username enumeration in Sync-in Server prior to 2.4.1 via timing on /api/auth/login.

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2026-58272	22 Sep 202616:31	–	circl
CVE	CVE-2026-58272	21 Sep 202620:31	–	cve
Cvelist	CVE-2026-58272 Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login (incomplete fix of the prior timing-attack advisory)	21 Sep 202620:31	–	cvelist
EUVD	EUVD-2026-84199	22 Sep 202614:49	–	euvd
Github Security Blog	Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login (incomplete fix of the prior timing-attack advisory)	22 Sep 202614:49	–	github
NVD	CVE-2026-58272	21 Sep 202621:17	–	nvd
osv_ghsa	GHSA-29HQ-23M2-2J47 Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login (incomplete fix of the prior timing-attack advisory)	22 Sep 202614:49	–	osv_ghsa
Positive Technologies	PT-2026-96251	21 Sep 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-58272: Observable Timing Discrepancy	21 Sep 202600:00	–	rapid7
Vulnrichment	CVE-2026-58272 Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login (incomplete fix of the prior timing-attack advisory)	21 Sep 202620:31	–	vulnrichment

Source	Link
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/58xxx/CVE-2026-58272.json
github	www.github.com/Sync-in/server/security/advisories/GHSA-29hq-23m2-2j47
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-58272

21 Oct 2026 02:58Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.15.3

EPSS0.00394