CVE-2026-58272: @sync-in/server Username Enumeration via Timing Side-Channel
Summary
CVE-2026-58272: validateUser() in backend/src/authentication/providers/mysql/auth-provider-mysql.service.ts returns immediately when the supplied login/email does not match any account, without ever calling comparePassword(): async vali... Affects @sync-in/server versions < 2.4.1. Fixed in 2.4.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @sync-in/server package is a Node.js application that provides backend services for user authentication and management. It utilizes MySQL for user data storage and employs bcrypt for password hashing. This package is designed to facilitate secure user login and account management functionalities. However, it has been found to be vulnerable to a timing attack that allows unauthorized users to enumerate valid usernames or emails.
Vulnerability Detail
The vulnerability arises from the validateUser() function in the authentication provider, which returns immediately if the provided login or email does not match any account. This early return bypasses the comparePassword() function, which includes a dummy-hash mechanism to mitigate timing attacks. As a result, an attacker can distinguish between non-existent and existing accounts based on response times, leading to potential account enumeration. The impact of this vulnerability is significant, as it allows attackers to identify valid usernames or emails, which can be exploited for credential stuffing, password spraying, or phishing attacks.
How To Fix
Latest published version: 2.6.0 as of 23 Oct 2026
npm install @sync-in/server@2.6.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.4.1
This is the first release that contains the fix.
npm install @sync-in/server@2.4.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not possible, a temporary workaround is to modify the
validateUser() function to always call comparePassword() with a null hash when no user is found. This can be done by adding the following line of code: await comparePassword(password, null);
before returning null.
Conclusion
In summary, CVE-2026-58272 is a significant vulnerability in the @sync-in/server package that allows for username enumeration via a timing attack. It is crucial to update to version 2.4.1 or later to mitigate this risk. Additionally, using tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for @sync-in/server →
FAQ
CVE-2026-58272 is a vulnerability in the @sync-in/server package that allows attackers to enumerate valid usernames or emails through a timing side-channel attack.
This vulnerability can lead to unauthorized users discovering valid account usernames or emails, which can be exploited for further attacks such as credential stuffing or phishing.
You can use Vulert, which monitors open-source vulnerabilities in your software. By simply uploading your package-lock.json file, you can receive real-time alerts for vulnerabilities.
The CVSS score for this vulnerability is 5.3, indicating a moderate level of severity.
If you cannot update the package right away, implement the suggested workaround to mitigate the risk until you can apply the official patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for @sync-in/server.
