https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 20:30:56 +0000 https://vulnerability.circl.lu/sighting/4ba7c973-7f5a-4596-900c-ca944bc81178/export {"uuid": "4ba7c973-7f5a-4596-900c-ca944bc81178", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-58272", "type": "published-proof-of-concept", "source": "https://github.com/Sync-in/server/security/advisories/GHSA-29hq-23m2-2j47", "content": "", "creation_timestamp": "2026-09-22T16:35:04.188025Z"} {"uuid": "4ba7c973-7f5a-4596-900c-ca944bc81178", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-58272", "type": "published-proof-of-concept", "source": "https://github.com/Sync-in/server/security/advisories/GHSA-29hq-23m2-2j47", "content": "", "creation_timestamp": "2026-09-22T16:35:04.188025Z"} https://vulnerability.circl.lu/sighting/4ba7c973-7f5a-4596-900c-ca944bc81178/export Tue, 22 Sep 2026 16:35:04 +0000 https://vulnerability.circl.lu/sighting/c8e4dd9c-45ab-4515-88fc-f689f3bcfff1/export {"uuid": "c8e4dd9c-45ab-4515-88fc-f689f3bcfff1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58272", "type": "seen", "source": "https://gist.github.com/alon710/0d291d38492cd0f426b608e184326562", "content": "# CVE-2026-58272: CVE-2026-58272: Username Enumeration via Timing Side-Channel in Sync-in Server\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-09-22\n> **Full Report:** https://cvereports.com/reports/CVE-2026-58272\n\n## Summary\nCVE-2026-58272 is a timing side-channel vulnerability in the authentication endpoint of Sync-in Server before version 2.4.1. Unauthenticated remote attackers can distinguish between valid and invalid usernames due to asymmetric execution paths. When processing invalid usernames, the database query returns early, skipping the computationally expensive bcrypt verification path that is normally triggered for valid accounts.\n\n## TL;DR\nA timing side-channel in Sync-in Server's login endpoint allows unauthenticated attackers to discover valid user accounts by analyzing response latency variations between existing and non-existent accounts.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-208: Observable Timing Discrepancy\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 5.3 (Medium)\n- **EPSS Score**: 0.00285 (21.23% Percentile)\n- **Exploit Status**: Proof-of-Concept (PoC) level\n- **CISA KEV Status**: Not listed\n\n## Affected Systems\n\n- Sync-in Server\n- **Sync-in Server**: < 2.4.1 (Fixed in: `2.4.1`)\n\n## Mitigation\n\n- Upgrade the Sync-in Server container or package installation to version 2.4.1 or higher.\n- Apply rate limiting at the reverse proxy (Nginx, HAProxy) to limit concurrent requests to the login endpoint.\n- Configure WAF rules to detect and flag high-frequency login failure patterns originating from single source IPs.\n\n**Remediation Steps:**\n1. Identify all deployed instances of Sync-in Server.\n2. Pull the updated docker images or code repository matching tag v2.4.1.\n3. Test authentication flows using both valid and invalid credentials to confirm identical timing signatures.\n4. Monitor application logs for credential-probing patterns and excessive unauthorized HTTP 401 response codes.\n\n## References\n\n- [GitHub Security Advisory GHSA-29hq-23m2-2j47](https://github.com/Sync-in/server/security/advisories/GHSA-29hq-23m2-2j47)\n- [NVD - CVE-2026-58272](https://nvd.nist.gov/vuln/detail/CVE-2026-58272)\n- [CVE Record on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-58272)\n- [CVE JSON Data Source File](https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/58xxx/CVE-2026-58272.json)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-58272) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-22T16:31:56.374748Z"} {"uuid": "c8e4dd9c-45ab-4515-88fc-f689f3bcfff1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58272", "type": "seen", "source": "https://gist.github.com/alon710/0d291d38492cd0f426b608e184326562", "content": "# CVE-2026-58272: CVE-2026-58272: Username Enumeration via Timing Side-Channel in Sync-in Server\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-09-22\n> **Full Report:** https://cvereports.com/reports/CVE-2026-58272\n\n## Summary\nCVE-2026-58272 is a timing side-channel vulnerability in the authentication endpoint of Sync-in Server before version 2.4.1. Unauthenticated remote attackers can distinguish between valid and invalid usernames due to asymmetric execution paths. When processing invalid usernames, the database query returns early, skipping the computationally expensive bcrypt verification path that is normally triggered for valid accounts.\n\n## TL;DR\nA timing side-channel in Sync-in Server's login endpoint allows unauthenticated attackers to discover valid user accounts by analyzing response latency variations between existing and non-existent accounts.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-208: Observable Timing Discrepancy\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 5.3 (Medium)\n- **EPSS Score**: 0.00285 (21.23% Percentile)\n- **Exploit Status**: Proof-of-Concept (PoC) level\n- **CISA KEV Status**: Not listed\n\n## Affected Systems\n\n- Sync-in Server\n- **Sync-in Server**: < 2.4.1 (Fixed in: `2.4.1`)\n\n## Mitigation\n\n- Upgrade the Sync-in Server container or package installation to version 2.4.1 or higher.\n- Apply rate limiting at the reverse proxy (Nginx, HAProxy) to limit concurrent requests to the login endpoint.\n- Configure WAF rules to detect and flag high-frequency login failure patterns originating from single source IPs.\n\n**Remediation Steps:**\n1. Identify all deployed instances of Sync-in Server.\n2. Pull the updated docker images or code repository matching tag v2.4.1.\n3. Test authentication flows using both valid and invalid credentials to confirm identical timing signatures.\n4. Monitor application logs for credential-probing patterns and excessive unauthorized HTTP 401 response codes.\n\n## References\n\n- [GitHub Security Advisory GHSA-29hq-23m2-2j47](https://github.com/Sync-in/server/security/advisories/GHSA-29hq-23m2-2j47)\n- [NVD - CVE-2026-58272](https://nvd.nist.gov/vuln/detail/CVE-2026-58272)\n- [CVE Record on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-58272)\n- [CVE JSON Data Source File](https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/58xxx/CVE-2026-58272.json)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-58272) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-22T16:31:56.374748Z"} https://vulnerability.circl.lu/sighting/c8e4dd9c-45ab-4515-88fc-f689f3bcfff1/export Tue, 22 Sep 2026 16:31:56 +0000