Sync-in Server EUVD-2026-84199

No authentication, privileges, or user interaction required - remotely reachable against default configurations of Sync-in Server versions prior to 2.4.1, because the login endpoint returns early for nonexistent accounts without running the bcrypt comparison performed for existing accounts, creating a measurable timing side channel. Exploitation is limited by network measurement noise: an attacker must send many requests per candidate and statistically average response times to reliably distinguish valid from invalid accounts, and the disclosure is confined to account existence (no password or session compromise directly). The value is realized only when chained into follow-on credential-stuffing, password-spraying, or phishing.

This is a low-severity information-disclosure weakness whose CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) accurately reflects limited impact: the only thing an attacker learns is whether a username or email is registered, via an observable timing discrepancy (bcrypt comparison performed for existing accounts but skipped for nonexistent ones). No EPSS score, KEV listing, or POC is present in the provided intelligence - there is no public exploit identified at time of analysis, and it is not on CISA KEV, so this is not an active-exploitation priority. The signals are internally consistent (network vector, no privileges, no user interaction, confidentiality-only impact), with no conflicts between the CVSS vector and the description. The one caveat worth flagging: reliable timing-oracle exploitation over a network is subject to jitter and typically requires many samples/statistical averaging, which arguably supports AC:H rather than the vendor's AC:L - verify realistic measurability in the target's deployment. Practically, this is an enumeration primitive that lowers the cost of downstream credential-stuffing, password-spraying, and phishing rather than a standalone breach; treat it as a hardening/defense-in-depth fix, not an emergency.

An unauthenticated attacker sends repeated login requests to the Sync-in Server login endpoint with candidate usernames/emails and measures response-time differences - valid accounts incur the bcrypt comparison delay while nonexistent ones return faster. The attacker builds a list of confirmed valid accounts and feeds it into credential-stuffing, password-spraying, or targeted phishing. No public exploit code is identified in the provided data, and network jitter means the attacker must average many samples per candidate.