sync-in/server Security Advisories | GitStock

medium2026-09-22

Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login (incomplete fix of the prior timing-attack advisory)

GHSA-29hq-23m2-2j47 · CVE-2026-58272

medium2026-09-22

Sync-in Server has a ReDoS via Unsanitized Regex in Sync Diff `pathFilters`

GHSA-jx63-h26r-8cph · CVE-2026-58270

high2026-09-22

Sync-in Server has a complete 2FA Bypass via `POST /api/auth/token`

GHSA-92cr-jxw4-5wjg · CVE-2026-58269

medium2026-09-22

@sync-in/server vulnerable to TOTP Brute-Force via `POST /api/app/sync/register`

GHSA-274f-6w77-8qm9 · CVE-2026-58271

high2026-06-05

Sync-in Server: SSRF protection bypass via IPv4-mapped IPv6 addresses in regExpPrivateIP

GHSA-q4x5-8cj6-52wg · CVE-2026-47684

medium2026-04-15

Sync-in Server has Username Enumeration via Timing Attack

GHSA-43fj-qp3h-hrh5 · CVE-2026-41161

medium2026-02-20

Sync-in Server has a stored cross-site scripting (XSS) vulnerability

GHSA-9jmq-xgjm-p8c2 · CVE-2025-67438