The /api/auth/login endpoint in older Sync‑in Server releases incorrectly uses the timing of its response to indicate whether a given username exists. By measuring the time difference between responses for existing and non‑existent usernames, an unauthenticated remote attacker can enumerate every valid account on the system. This flaw exposes the system to credential discovery, which can subsequently aid in privilege escalation or other lateral moves. The weakness is a timing channel (CWE‑208). Attackers need only send HTTP requests to the login endpoint; no prior authentication is required.

The flaw is present in all Sync‑in Server releases before version 2.2.0. The vendor has released a patched version, 2.2.0, which eliminates the timing discrepancy. Systems running older versions without the fix are susceptible.

The CVSS score of 6.9 indicates a moderate to high risk. Because EPSS data is not available, the likelihood of exploitation cannot be quantified, but the vulnerability is exploitable remotely from any host with network connectivity to the service. The issue is not yet listed in CISA's KEV catalog, so it has not yet been confirmed as a widely exploited vulnerability. Nonetheless, the potential for username enumeration justifies prompt action, especially for services exposed to the public internet.