{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/sync-in/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:sync_in:server:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-58269"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Sync-in Server (\u003c= 2.3.0)"],"_cs_severities":["high"],"_cs_tags":["2fa-bypass","authentication-bypass","webserver"],"_cs_type":"advisory","_cs_vendors":["Sync-in"],"content_html":"\u003cp\u003eSync-in Server versions 2.3.0 and earlier contain a security vulnerability in the /api/auth/token endpoint that results in a complete bypass of TOTP two-factor authentication. While the standard /api/auth/login endpoint correctly enforces 2FA by checking the user's twoFaEnabled status and requiring a token verification flow, the /api/auth/token endpoint relies solely on the AuthLocalGuard for username and password validation. Upon successful authentication, the server immediately issues unrestricted Bearer access and refresh JWTs without verifying the TOTP status. This allows an attacker who already possesses valid user credentials to generate a valid session token, effectively neutralizing the security provided by 2FA. This flaw highlights an inconsistency in security policy implementation between the server's authentication routes, specifically within auth.controller.ts and auth.service.ts.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker obtains valid username and password credentials for a target user via prior reconnaissance or credential harvesting.\u003c/li\u003e\n\u003cli\u003eAttacker inspects target environment to confirm it is a Sync-in Server instance running version 2.3.0 or earlier.\u003c/li\u003e\n\u003cli\u003eAttacker identifies the /api/auth/token endpoint as a potential authentication route during application profiling.\u003c/li\u003e\n\u003cli\u003eAttacker constructs a POST request to /api/auth/token containing the valid username and password of the 2FA-enabled target account.\u003c/li\u003e\n\u003cli\u003eThe Sync-in Server processes the request, validating credentials via AuthLocalGuard, but fails to check the user.twoFaEnabled status.\u003c/li\u003e\n\u003cli\u003eThe server generates and returns a JSON response containing unrestricted Bearer access and refresh JWTs to the attacker.\u003c/li\u003e\n\u003cli\u003eAttacker uses the acquired Bearer token in the Authorization header to authenticate against protected API endpoints, such as /api/users/me.\u003c/li\u003e\n\u003cli\u003eThe server accepts the forged session, granting the attacker unauthorized access to the target's account and profile data without a second factor.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an attacker to bypass multi-factor authentication, granting them full access to the target's account. This leads to unauthorized data exfiltration, account takeover, and potential lateral movement within the application environment. Any account with 2FA enabled is vulnerable, significantly reducing the security posture of the organization.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized actions for detection engineering teams:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy detection for anomalous HTTP POST requests to /api/auth/token originating from non-standard user agents or IPs associated with external reconnaissance.\u003c/li\u003e\n\u003cli\u003eImplement monitoring for a high volume of failed or successful authentication attempts targeted specifically at the /api/auth/token endpoint compared to the standard /api/auth/login route.\u003c/li\u003e\n\u003cli\u003ePatch Sync-in Server to a version later than 2.3.0 that implements the 2FA gate within the token endpoint logic.\u003c/li\u003e\n\u003cli\u003eAudit logs for instances where access tokens are issued to users with twoFaEnabled set to true without a preceding successful 2FA verification event.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-22T19:53:49Z","date_published":"2026-09-22T19:53:49Z","id":"https://feed.craftedsignal.io/briefs/2026-09-sync-in-2fa-bypass/","summary":"Sync-in Server v2.3.0 and earlier is vulnerable to a 2FA bypass in the /api/auth/token endpoint, allowing attackers with known credentials to obtain unrestricted JWTs without providing TOTP codes.","title":"Sync-in Server 2FA Bypass via Token API","url":"https://feed.craftedsignal.io/briefs/2026-09-sync-in-2fa-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Sync-In","version":"https://jsonfeed.org/version/1.1"}