Description

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, `POST /api/auth/token` authenticates with username and password only, then calls `getTokens()`, which returns full access and refresh JWTs without checking whether the account has TOTP 2FA enabled. An attacker with stolen or phished credentials can bypass 2FA in a single request. The parallel login endpoint (`POST /api/auth/login`) correctly enforces 2FA by calling `setCookies(user, res, true)`, which gates on `user.twoFaEnabled`. Version 2.4.0 patches the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-21T20:17:26.837Z",
  "pubdate": "2026-09-21T20:17:26.837Z",
  "executiveSummary": "Sync-in Server versions prior to 2.4.0 contain a critical authentication bypass vulnerability within the API token generation flow. The vulnerability allows an attacker possessing valid user credentials to circumvent mandatory Time-based One-Time Password (TOTP) two-factor authentication (2FA).\nThe flaw resides in the 'POST /api/auth/token' endpoint, which fails to validate the 'twoFaEnabled' status of the user account during the authentication process. By directly invoking this endpoint, an attacker can obtain valid access and refresh JWTs, effectively gaining unauthorized access to the account without completing the required secondary authentication challenge.\nThis vulnerability poses a significant risk to the confidentiality and integrity of stored data, as the bypass facilitates unauthorized access even for accounts where administrators have enforced 2FA. Successful exploitation requires only the knowledge of a user's primary credentials, such as a username and password. This issue is resolved in version 2.4.0 by ensuring that token issuance endpoints strictly enforce 2FA verification logic, consistent with the behavior implemented in the '/api/auth/login' endpoint.",
  "technicalDetails": "The vulnerability is rooted in an inconsistent implementation of authentication security controls across different API endpoints within the Sync-in Server authentication module. Specifically, the application exposes two distinct methods for obtaining session tokens: 'POST /api/auth/login' and 'POST /api/auth/token'.\nThe 'POST /api/auth/login' endpoint correctly follows secure design principles by executing 'setCookies(user, res, true)', a function that evaluates the 'user.twoFaEnabled' boolean property. If this property is true, the application gates the issuance of session tokens behind a secondary authentication challenge, preventing unauthorized access even with valid primary credentials.\nConversely, the 'POST /api/auth/token' endpoint suffers from a critical logic flaw. Upon receiving a username and password, the application authenticates the user but immediately invokes the 'getTokens()' function to generate and return full-privilege JWTs. This internal function call fails to perform a conditional check against the user's 2FA status or the existence of a verified TOTP setup. Consequently, the server effectively ignores the security configuration of the account, granting an unrestricted authentication state to any party capable of authenticating with the primary password.\nThe attack flow proceeds as follows: An attacker acquires a user's primary credentials through phishing, credential stuffing, or other exfiltration methods. Instead of utilizing the standard login flow that would trigger a 2FA prompt, the attacker targets the 'POST /api/auth/token' endpoint with the stolen credentials. Because this endpoint lacks a gatekeeper for 2FA, the server returns valid JWTs immediately upon verification of the primary password. The attacker can then utilize these tokens to access the user's file storage, collaboration data, and synchronization features, completely bypassing the intended multi-factor defense. This bypass is possible in any network environment where the API is accessible, requiring no further interaction from the legitimate user. The impact is a total loss of authentication integrity, rendering 2FA protections ineffective for the affected versions."
}