EUVD-2026-28551Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable default endpoint, no authentication required, low confidentiality impact (username enumeration only), no integrity or availability impact.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
4DescriptionGitHub Advisory
Sync-in Server is a secure, open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.2.0, the /api/auth/login endpoint contains a logic flaw that allows unauthenticated remote attackers to enumerate valid usernames by measuring the application's response time. This issue has been patched in version 2.2.0.
AnalysisAI
Username enumeration via observable timing discrepancy affects Sync-in Server versions prior to 2.2.0, exposing valid account names to unauthenticated remote attackers through a logic flaw in the /api/auth/login endpoint. The authentication handler short-circuits immediately when a submitted username does not exist in the database, producing responses averaging 95-100ms, while valid usernames that proceed to password hashing return in approximately 350-400ms - a 250-300ms gap measurable by automated tooling. No confirmed active exploitation (not in CISA KEV), but SSVC classifies this as automatable with a publicly validated proof-of-concept technique (TickTock Enum via Burp Suite); EPSS at 0.14% (34th percentile) suggests limited observed exploitation activity to date.
Technical ContextAI
Sync-in Server is an open-source, self-hosted file storage, sharing, and collaboration platform distributed as an npm package (@sync-in/server). The vulnerability is rooted in CWE-208 (Observable Timing Discrepancy), a side-channel class where application behavior leaks information through differential execution time. The flaw resides in the authentication query service (users-queries.service.ts, lines 91-95): when an unknown username is submitted, the code path terminates early without performing a password hash comparison, producing a significantly faster response than when a valid username is found and hashed. Secure authentication endpoints must apply constant-time logic or dummy hash comparisons for all requests regardless of username validity. CPE cpe:2.3:a:sync-in:server:*:*:*:*:*:*:*:* covers all affected versions up to and excluding 2.2.0. The npm package @sync-in/server confirms the vulnerable range as <= 2.1.0.
RemediationAI
Upgrade Sync-in Server to version 2.2.0 or later; this is the vendor-released patch confirmed in the GitHub release at https://github.com/Sync-in/server/releases/tag/v2.2.0 and in security advisory GHSA-43fj-qp3h-hrh5. The fix addresses the short-circuit logic in the authentication path so that response cadence is consistent regardless of username validity. If immediate upgrade is not possible, a compensating control is to place the /api/auth/login endpoint behind a rate-limiting reverse proxy (e.g., nginx limit_req or Cloudflare rate limiting) to reduce the statistical reliability of timing measurements and increase attacker cost - note this does not eliminate the timing channel but significantly degrades attack precision. Additionally, enabling account lockout or CAPTCHA on repeated failed logins limits the number of probes an attacker can make. These mitigations have the trade-off of potentially impacting legitimate users under high-load authentication scenarios.
Traccar Traccar Server version 4.0 and earlier contains a CWE-94: Improper Control of Generation of Code ('Code Injectio
Account takeover in self-hosted Bitwarden Server before 2026.6.0 lets a low-privileged organization member steal any oth
Provider service users in Bitwarden Server Cloud can hijack arbitrary organizations via unauthorized API endpoint access
NoMachine Server is affected by Integer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack compl
NoMachine Server is affected by Buffer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack comple
Authentication bypass in Bitwarden Server versions prior to 2026.4.1 allows authenticated users with SCIM management pri
JetAudio jetCast Server 2.0 contains a stack-based buffer overflow vulnerability in the Log Directory configuration fiel
A broken authentication vulnerability in 4D SAS 4D Server software v17, v18, v19 R7, and earlier allows attackers to sen
An information disclosure vulnerability in 4D SAS 4D Server Application v17, v18, v19 R7 and earlier allows attackers to
Privilege escalation in self-hosted Bitwarden Server before 2026.5.0 lets an authenticated organization member holding a
Audit log integrity across all Bitwarden Server organizations can be undermined by any authenticated user, who may injec
In the webmail component in IceWarp Server 11.3.1.5, there was an XSS vulnerability discovered in the "language" paramet
Same weakness CWE-208 – Observable Timing Discrepancy
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today