GHSA-43fj-qp3h-hrh5
NoneCVSS
—
EPSS
—
Published
Apr 15, 2026
CISA due date
—
The record
Sync-in Server has Username Enumeration via Timing Attack
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @sync-in/server | 0 | 2.2.0 |
Related vulnerabilities
- CVE-2026-41161 Sync-in Server is a secure, open-source platform for file storage, sharing… Same vulnerability
- CVE-2026-47684 Sync-in Server is a secure, open-source platform for file storage, sharing… Also affects @sync-in/server
- GHSA-q4x5-8cj6-52wg Sync-in Server: SSRF protection bypass via IPv4-mapped IPv6 addresses in regExpPrivateIP Also affects @sync-in/server
- GHSA-9jmq-xgjm-p8c2 Sync-in Server has a stored cross-site scripting (XSS) vulnerability Also affects @sync-in/server
- CVE-2025-67438 A Stored Cross-Site Scripting (XSS) vulnerability in Sync-in Server before 1.9.3 allows… Also affects @sync-in/server
- CVE-2026-87946 Observable Timing Discrepancy vulnerability in Drupal SAML SSO - Service Provider allows… CWE-208
- CVE-2026-49265 OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. CWE-208
- CVE-2026-77696 Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret… CWE-208