CVE-2026-58270

creationtimestamp| type| source ---|---|--- 2026-09-22 16:35:08+00:00| published-proof-of-concept| https://github.com/Sync-in/server/security/advisories/GHSA-jx63-h26r-8cph 2026-09-22 19:32:27+00:00| seen| https://gist.github.com/alon710/b536815814568f1fe4f87321daa1216e...

EUVD-2026-84199

Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login incomplete fix of the prior timing-attack advisory...

Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login (incomplete fix of the prior timing-attack advisory)

Summary validateUser in backend/src/authentication/providers/mysql/auth-provider-mysql.service.ts returns immediately when the supplied login/email does not match any account, without ever calling comparePassword: async validateUserloginOrEmail: string, password: string, ip?: string, scope?:...

EUVD-2026-84198

Sync-in Server has a ReDoS via Unsanitized Regex in Sync Diff pathFilters...

Sync-in Server has a ReDoS via Unsanitized Regex in Sync Diff `pathFilters`

Affected component: Sync-in Server v2.3.0, POST /api/app/sync/operation/diff/:id, vulnerable implementation of pathFilters in backend/src/applications/sync/dtos/sync-operations.dto.ts. Summary In the vulnerable version, the sync diff endpoint accepted a user-controlled regex pattern through...

GHSA-JX63-H26R-8CPH Sync-in Server has a ReDoS via Unsanitized Regex in Sync Diff `pathFilters`

Affected component: Sync-in Server v2.3.0, POST /api/app/sync/operation/diff/:id, vulnerable implementation of pathFilters in backend/src/applications/sync/dtos/sync-operations.dto.ts. Summary In the vulnerable version, the sync diff endpoint accepted a user-controlled regex pattern through...

EUVD-2026-84115

Sync-in Server has a complete 2FA Bypass via POST /api/auth/token...

Sync-in Server has a complete 2FA Bypass via `POST /api/auth/token`

Affected component: Sync-in Server v2.3.0, POST /api/auth/token auth.controller.ts:50-55. Required attacker capability: Valid username and password for a 2FA-enabled account. Summary POST /api/auth/token authenticates with username and password only, then calls getTokens, which returns unrestrict...

EUVD-2026-84112

@sync-in/server vulnerable to TOTP Brute-Force via POST /api/app/sync/register...

@sync-in/server vulnerable to TOTP Brute-Force via `POST /api/app/sync/register`

Affected component: Sync-in Server v2.3.0, POST /api/app/sync/register. Required attacker capability: Valid login and password for a TOTP-enabled account with desktop sync permission. Summary POST /api/app/sync/register accepts credentials and a TOTP code to register a desktop sync client. In the...

CVE-2026-58272

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Versions prior to 2.4.1 contain an observable timing discrepancy in the login endpoint because authentication attempts for nonexistent accounts return without performing the bcrypt comparison used for...

CVE-2026-58270

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, the sync diff endpoint compiles a user-supplied string into a RegExp with no complexity validation. A catastrophic-backtracking pattern e.g. ^a++b blocks the Node.js event loop...

CVE-2026-58272 Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login (incomplete fix of the prior timing-attack advisory)

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Versions prior to 2.4.1 contain an observable timing discrepancy in the login endpoint because authentication attempts for nonexistent accounts return without performing the bcrypt comparison used for...

CVE-2026-58272 Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login (incomplete fix of the prior timing-attack advisory)

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Versions prior to 2.4.1 contain an observable timing discrepancy in the login endpoint because authentication attempts for nonexistent accounts return without performing the bcrypt comparison used for...

CVE-2026-58272

Sync-in Server (open-source file storage and collaboration platform) prior to 2.4.1 exposes a timing side-channel on the POST /api/auth/login endpoint. The root cause is that authentication attempts for nonexistent accounts skip the bcrypt comparison performed for existing accounts, producing a m...

CVE-2026-58270

Sync-in Server , an open-source platform for file storage, sharing, and syncing, is vulnerable to a ReDoS (Regular Expression Denial of Service) in the sync diff pathFilters parameter prior to version 2.4.0 . The endpoint compiles a user-supplied string directly into a RegExp without complexity v...

CVE-2026-58270 Sync-in Server has a ReDoS via Unsanitized Regex in Sync Diff `pathFilters`

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, the sync diff endpoint compiles a user-supplied string into a RegExp with no complexity validation. A catastrophic-backtracking pattern e.g. ^a++b blocks the Node.js event loop...

CVE-2026-58270 Sync-in Server has a ReDoS via Unsanitized Regex in Sync Diff `pathFilters`

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, the sync diff endpoint compiles a user-supplied string into a RegExp with no complexity validation. A catastrophic-backtracking pattern e.g. ^a++b blocks the Node.js event loop...

CVE-2026-58269

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, POST /api/auth/token authenticates with username and password only, then calls getTokens, which returns full access and refresh JWTs without checking whether the account has TO...

CVE-2026-58271

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, POST /api/app/sync/register accepts credentials and a TOTP code to register a desktop sync client. On a failed TOTP, SyncClientsManager.register calls updateAccessesuser, ip,...