Sync-in vulnerabilities
We track 2 vulnerabilities in Sync-in products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on September 21, 2026.
2vulnerabilities
0critical
2high
0exploited
7.9average CVSS score
Latest Sync-in vulnerabilities
- 8.1 High severity
server: Authentication Bypass Using an Alternate Path or Channel
Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, `POST /api/auth/token` authenticates with username and password only, then calls `getTokens()`, which returns full access and refresh JWTs
- 7.7 High severity
server: Server-Side Request Forgery
Sync-in Server is a secure, open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.3.0, the private IP blocklist regex used in the URL download feature does not match IPv4-mapped IPv6 addresses (e.g. ::ffff:127.0.0.1), a