CVE-2026-58271: @sync-in/server TOTP Brute-Force Vulnerability via POST /api/app/sync/register
Summary
CVE-2026-58271: @sync-in/server vulnerable to TOTP Brute-Force via POST /api/app/sync/register. Affects @sync-in/server versions < 2.4.0. Fixed in 2.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @sync-in/server package is designed to facilitate synchronization services for applications, enabling users to maintain data consistency across devices. It supports features such as two-factor authentication (2FA) using Time-based One-Time Passwords (TOTP) to enhance security. However, a vulnerability in version 2.3.0 allows attackers to exploit the TOTP verification process, potentially compromising user accounts with desktop sync permissions.
Vulnerability Detail
The vulnerability arises from the handling of TOTP codes during the registration of desktop sync clients via the POST /api/app/sync/register endpoint. When a TOTP attempt fails, the system incorrectly maintains the password attempt count, preventing account lockout after multiple failed attempts. This flaw allows an attacker with valid credentials to brute-force TOTP codes without triggering security measures, leading to unauthorized access and the ability to disable multi-factor authentication (MFA). The issue is rooted in the logic of the updateAccesses function, which fails to increment the passwordAttempts counter on TOTP failures.
How To Fix
Minimum fixed version
2.4.0
This is the first release that contains the fix.
npm install @sync-in/server@2.4.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, implement an IP and/or account-based rate limiter on the POST /api/app/sync/register endpoint to mitigate the risk of brute-force attacks until the package can be updated.
Conclusion
The vulnerability CVE-2026-58271 in the @sync-in/server package poses a significant risk by allowing brute-force attacks on TOTP codes. Users are advised to update to version 2.4.0 or later to mitigate this issue and consider implementing additional security measures in the interim.
See every vulnerability recorded for @sync-in/server →
FAQ
The vulnerability allows attackers to brute-force TOTP codes without triggering account lockout, compromising user accounts with valid credentials.
The vulnerability affects version 2.3.0 and earlier of the @sync-in/server package.
You can use Vulert to monitor and alert for vulnerabilities in your application. Visit Vulert Scanner to check if your application is affected by this vulnerability.
The CVSS score of this vulnerability is 6.8, indicating a moderate severity level.
If immediate updates are not possible, implement rate limiting on the affected endpoint to reduce the risk of brute-force attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for @sync-in/server.
