{"action":"Upgrade @sync-in/server to 2.4.1 or later.","affected":[{"fixed":"2.4.1","introduced":"0"}],"component":"@sync-in/server","cve_ids":["CVE-2026-58272"],"ecosystem":"npm","epss":0.00394,"exploited":false,"fixed_versions":["2.4.1"],"ghsa_id":"GHSA-29hq-23m2-2j47","id":"tcs_01M5KESNW0PS8S0521RV2DZMTT","modified_at":"2026-09-22T15:00:48.902276260Z","published_at":"2026-09-22T14:49:23Z","references":["https://osv.dev/vulnerability/GHSA-29hq-23m2-2j47","https://github.com/Sync-in/server/security/advisories/GHSA-29hq-23m2-2j47","https://nvd.nist.gov/vuln/detail/CVE-2026-58272","https://github.com/Sync-in/server/commit/b80efe04574039a7a302c0e1007f03a7dbe6a633","https://github.com/Sync-in/server","https://github.com/Sync-in/server/releases/tag/v2.4.1"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-29hq-23m2-2j47","url":"https://osv.dev/vulnerability/GHSA-29hq-23m2-2j47"}],"summary":"Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login (incomplete fix of the prior timing-attack advisory)"}