An authentication bypass vulnerability in Sync-in Server enables attackers with stolen credentials to circumvent two-factor authentication, potentially leading to unauthorized account access.

The application fails to perform a capability check for two-factor authentication on the /api/auth/token endpoint, allowing a low-privileged authenticated user to obtain valid access and refresh tokens without completing the TOTP challenge.

The vulnerability significantly weakens the security posture of the platform by rendering multi-factor authentication controls ineffective. Successful exploitation allows an attacker with compromised credentials to gain full account access, which may result in unauthorized data exposure, file manipulation, or further escalation within the collaboration environment. Given the high CVSS score of 8.1, this flaw poses a substantial risk to information confidentiality and integrity.

Immediate Action: Update Sync-in Server to version 2.4.0 or later to ensure that the token issuance process correctly validates the two-factor authentication status.

Proactive Monitoring: Review authentication and access logs for unusual patterns, specifically focusing on successful token requests that lack a corresponding TOTP verification event.

Compensating Controls: Implement network-level access controls or enforce IP-based restrictions for the API endpoints if immediate patching is not feasible.

Public Exploit Available: No

This vulnerability represents a critical failure in the authentication logic of Sync-in Server. Organizations currently running versions prior to 2.4.0 should prioritize the update to the patched version immediately to restore the efficacy of two-factor authentication and prevent unauthorized account takeover.