QwikSec

Security Database

CVE

CWE

Training

CVE-2026-41161

Published: May 8, 2026

Modified: May 11, 2026

PUBLISHED

Description

Sync-in Server is a secure, open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.2.0, the /api/auth/login endpoint contains a logic flaw that allows unauthenticated remote attackers to enumerate valid usernames by measuring the application's response time. This issue has been patched in version 2.2.0.

Vendor	Product	Versions
Sync-in	server	affected `< 2.2.0`

Weaknesses (CWE)

References

https://github.com/Sync-in/server/security/advisories/GHSA-43fj-qp3h-hrh5

x_refsource_CONFIRM

https://github.com/Sync-in/server/releases/tag/v2.2.0

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.