EUVD-2026-84115
GHSA-92cr-jxw4-5wjg
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Network single-request bypass with no user interaction; PR:L because the attacker must already hold valid credentials; C:H/I:H for full account/file access, A:N as no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, POST /api/auth/token authenticates with username and password only, then calls getTokens(), which returns full access and refresh JWTs without checking whether the account has TOTP 2FA enabled. An attacker with stolen or phished credentials can bypass 2FA in a single request. The parallel login endpoint (POST /api/auth/login) correctly enforces 2FA by calling setCookies(user, res, true), which gates on user.twoFaEnabled. Version 2.4.0 patches the issue.
AnalysisAI
Credential-holding attackers can completely bypass TOTP two-factor authentication on Sync-in Server versions prior to 2.4.0 by sending a single unauthenticated-looking request to POST /api/auth/token, which issues full access and refresh JWTs without ever checking the account's twoFaEnabled flag. The flaw is only exploitable by an authenticated party in the sense that the attacker must already hold a valid username and password obtained through phishing or credential theft (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1), and it only yields an advantage against accounts that actually have TOTP enabled; the parallel POST /api/auth/login endpoint enforces the second factor correctly. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the attacker to already hold valid account credentials (username + password), obtained externally via phishing or credential theft - this is the PR:L in the vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine, high-value authentication design flaw rather than an inflated CVSS entry. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Sync-in Server to 2.4.0 or later, which is the version the project identifies as patching this issue by routing the token endpoint through the same twoFaEnabled check used by the login endpoint; see the vendor advisory at https://github.com/Sync-in/server/security/advisories/GHSA-92cr-jxw4-5wjg for confirmation of the fixed release before scheduling the change window. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Sync-in Server deployments and isolate or closely monitor any instance running a version prior to 2.4.0, especially accounts with TOTP enabled; review logs for POST /api/auth/token requests and successful JWT issuance to TOTP-enabled users, revoke all access and refresh tokens associated with suspicious activity, force password resets for potentially compromised accounts, and restrict network access to /api/auth/token to trusted IP addresses or administrative networks if operationally feasible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Traccar Traccar Server version 4.0 and earlier contains a CWE-94: Improper Control of Generation of Code ('Code Injectio
Account takeover in self-hosted Bitwarden Server before 2026.6.0 lets a low-privileged organization member steal any oth
Full user impersonation in the Laci Synchroni sync server (backend prior to 1.2.3) lets an attacker take over any accoun
Provider service users in Bitwarden Server Cloud can hijack arbitrary organizations via unauthorized API endpoint access
NoMachine Server is affected by Integer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack compl
NoMachine Server is affected by Buffer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack comple
Authentication bypass in Bitwarden Server versions prior to 2026.4.1 allows authenticated users with SCIM management pri
JetAudio jetCast Server 2.0 contains a stack-based buffer overflow vulnerability in the Log Directory configuration fiel
A broken authentication vulnerability in 4D SAS 4D Server software v17, v18, v19 R7, and earlier allows attackers to sen
An information disclosure vulnerability in 4D SAS 4D Server Application v17, v18, v19 R7 and earlier allows attackers to
Privilege escalation in self-hosted Bitwarden Server before 2026.5.0 lets an authenticated organization member holding a
Audit log integrity across all Bitwarden Server organizations can be undermined by any authenticated user, who may injec
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today