CVE-2026-58271

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, POST /api/app/sync/register accepts credentials and a TOTP code to register a desktop sync client. On a failed TOTP, SyncClientsManager.register calls updateAccessesuser, ip,...

CVE-2026-58271

Sync-in Server , an open-source platform for file storage and collaboration, is vulnerable to TOTP brute-force in versions prior to 2.4.0 . The endpoint POST /api/app/sync/register fails to increment the passwordAttempts counter on TOTP failure due to a freeze branch in updateAccesses(), so the l...

CVE-2026-58271 @sync-in/server vulnerable to TOTP Brute-Force via `POST /api/app/sync/register`

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, POST /api/app/sync/register accepts credentials and a TOTP code to register a desktop sync client. On a failed TOTP, SyncClientsManager.register calls updateAccessesuser, ip,...