DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-58272: CVE-2026-58272: Username Enumeration via Timing Side-Channel in Sync-in Server

#security #cve #cybersecurity

CVE-2026-58272: Username Enumeration via Timing Side-Channel in Sync-in Server

Vulnerability ID: CVE-2026-58272
CVSS Score: 5.3
Published: 2026-09-22

CVE-2026-58272 is a timing side-channel vulnerability in the authentication endpoint of Sync-in Server before version 2.4.1. Unauthenticated remote attackers can distinguish between valid and invalid usernames due to asymmetric execution paths. When processing invalid usernames, the database query returns early, skipping the computationally expensive bcrypt verification path that is normally triggered for valid accounts.

TL;DR

A timing side-channel in Sync-in Server's login endpoint allows unauthenticated attackers to discover valid user accounts by analyzing response latency variations between existing and non-existent accounts.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-208: Observable Timing Discrepancy
  • Attack Vector: Network (AV:N)
  • CVSS Score: 5.3 (Medium)
  • EPSS Score: 0.00285 (21.23% Percentile)
  • Exploit Status: Proof-of-Concept (PoC) level
  • CISA KEV Status: Not listed

Affected Systems

  • Sync-in Server
  • Sync-in Server: < 2.4.1 (Fixed in: 2.4.1)

Code Analysis

Commit: b80efe0

Introduce timing mitigations by executing dummy bcrypt checks for non-existent users in mysql, ldap, and oidc provider modules.

Mitigation Strategies

  • Upgrade the Sync-in Server container or package installation to version 2.4.1 or higher.
  • Apply rate limiting at the reverse proxy (Nginx, HAProxy) to limit concurrent requests to the login endpoint.
  • Configure WAF rules to detect and flag high-frequency login failure patterns originating from single source IPs.

Remediation Steps:

  1. Identify all deployed instances of Sync-in Server.
  2. Pull the updated docker images or code repository matching tag v2.4.1.
  3. Test authentication flows using both valid and invalid credentials to confirm identical timing signatures.
  4. Monitor application logs for credential-probing patterns and excessive unauthorized HTTP 401 response codes.

References

Read the full report for CVE-2026-58272 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)