CVE-2026-58269

Name of the Vulnerable Software and Affected Versions Sync-in Server versions prior to 2.4.0

Description An issue exists where the POST /api/auth/token endpoint authenticates users using only a username and password, subsequently calling the getTokens() function to return full access and refresh JSON Web Tokens (JWTs) without verifying if Time-based One-Time Password (TOTP) two-factor authentication (2FA) is enabled for the account. This allows an attacker with valid credentials to bypass 2FA in a single request. In contrast, the POST /api/auth/login endpoint correctly enforces 2FA by utilizing the setCookies() function, which checks the user.twoFaEnabled variable.

Recommendations Update Sync-in Server to version 2.4.0. As a temporary mitigation, restrict access to the POST /api/auth/token endpoint.