A vulnerability in the Sync-in Server authentication mechanism allows an authenticated attacker to bypass account lockout protections and disable multi-factor authentication, posing a severe risk to account security.

This flaw exists in the SyncClientsManager.register function, where failed TOTP attempts do not correctly increment the password attempt counter. This allows a user to perform an unlimited number of authentication attempts against the system, effectively bypassing the lockout gate and enabling unauthorized modifications such as the permanent removal of MFA.

The ability to bypass authentication lockouts and disable MFA significantly undermines the integrity of user accounts and administrative access. A successful exploit could lead to full account takeover, unauthorized data access, and potential persistence by malicious actors. Although the CVSS score is 6.8, the ability to disable security controls like MFA elevates the operational risk to the environment.

Immediate Action: Update Sync-in Server to version 2.4.0 or later to ensure the authentication lockout logic is correctly enforced.

Proactive Monitoring: Review authentication and API access logs for high volumes of failed login attempts or unusual patterns involving the sync registration endpoints.

Compensating Controls: Implement rate limiting at the network or Web Application Firewall (WAF) layer to restrict the frequency of requests to the registration and authentication API endpoints.

Public Exploit Available: No

The vulnerability represents a significant lapse in security control enforcement within the Sync-in Server platform. Given the potential for total account compromise through MFA bypass, administrators must prioritize the update to version 2.4.0. Failure to patch leaves the environment susceptible to systematic brute-force attacks that the system is currently unable to block.