What’s Vulnerable › Products

Sync-in server vulnerabilities

8 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 8 published in the last 12 months.

Check whether your Sync-in server version is affected

Latest Sync-in server vulnerabilities

• CVE-2026-58272 — Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login (incomplete fix of the prior timing-attack advisory) (CVSS 5.3)
• CVE-2026-58270 — Sync-in Server has a ReDoS via Unsanitized Regex in Sync Diff `pathFilters` (CVSS 6.5)
• CVE-2026-58271 — @sync-in/server vulnerable to TOTP Brute-Force via `POST /api/app/sync/register` (CVSS 6.8)
• CVE-2026-58269 — Sync-in Server has a complete 2FA Bypass via `POST /api/auth/token` (CVSS 8.1)
• CVE-2026-47684 — Sync-in Server: SSRF protection bypass via IPv4-mapped IPv6 addresses in regExpPrivateIP (CVSS 7.7)
• CVE-2026-41161 — Username Enumeration via Timing Attack (CVSS 5.3)
• CVE-2025-67438 — (CVSS 6.1)
• CVE-2025-56869 — (CVSS 5.3)